CVE-2025-57392: Benimpos Privilege Escalation Vulnerability

CVE-2025-57392 Overview

CVE-2025-57392 is an insecure file permissions vulnerability affecting BenimPOS Masaustu 3.0.x. The installation directory grants the Everyone and BUILTIN\Users groups FILE_ALL_ACCESS permissions on application binaries. Any local user can replace or modify .exe and .dll files within the installation path. When another user or an elevated process later launches the application, the attacker-supplied binary executes in that security context. This behavior enables local privilege escalation and arbitrary code execution. The weakness is categorized as [CWE-732] Incorrect Permission Assignment for Critical Resource.

Critical Impact
A low-privileged local user can replace application binaries in the BenimPOS installation directory and achieve code execution as any user who subsequently runs the application, including administrators.

Affected Products

BenimPOS Masaustu 3.0
BenimPOS Masaustu 3.0.x branch
Installations retaining default directory ACLs

Discovery Timeline

2025-09-10 - CVE-2025-57392 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57392

Vulnerability Analysis

BenimPOS Masaustu 3.0.x installs to a directory with overly permissive access control lists (ACLs). The installer applies FILE_ALL_ACCESS rights to the Everyone and BUILTIN\Users principals across the installation folder. This grants read, write, execute, delete, and permission-change rights on every file inside, including executables and dynamic libraries.

A local attacker with standard user privileges can overwrite the application's .exe and .dll files with malicious equivalents. When a higher-privileged user launches BenimPOS, or when the application is executed under an elevated context such as a scheduled task or service, the substituted binary runs with that user's privileges. This produces a straightforward path to local privilege escalation.

Root Cause

The root cause is improper permission assignment during installation. The installer fails to restrict write access to trusted administrators and instead inherits or applies world-writable ACLs on program files. This violates the Windows security principle that binaries under Program Files should only be modifiable by SYSTEM and Administrators.

Attack Vector

Exploitation requires local access with any authenticated user account. The attacker enumerates ACLs on the BenimPOS install directory, confirms write access, and replaces a target binary or DLL with malicious code. The attacker then waits for an administrator, service account, or another user to launch the application. See the GitHub PoC Repository and GitHub CVE-2025-57392 Details for reproduction steps.

Detection Methods for CVE-2025-57392

Indicators of Compromise

Unexpected modification timestamps on .exe or .dll files within the BenimPOS installation directory.
Presence of unsigned or invalidly signed binaries where signed vendor binaries were previously installed.
Child processes spawned from BenimPOS executables that do not match legitimate application behavior, such as cmd.exe, powershell.exe, or network utilities.

Detection Strategies

Audit ACLs on the BenimPOS install directory using icacls and flag entries granting Everyone or BUILTIN\Users write access.
Enable Windows file integrity auditing (Object Access, event ID 4663) on the installation path to log write and delete operations.
Monitor for binary replacement patterns where a non-administrative process writes to a file under Program Files or a similar application directory.

Monitoring Recommendations

Configure endpoint telemetry to record process creation events (Sysmon event ID 1) for BenimPOS binaries and alert on anomalous parent-child relationships.
Track file creation and modification events (Sysmon event IDs 11 and 2) targeting the BenimPOS directory from non-installer processes.
Correlate binary modification events with subsequent process launches by privileged users to identify successful exploitation chains.

How to Mitigate CVE-2025-57392

Immediate Actions Required

Remove Everyone and BUILTIN\Users write permissions from the BenimPOS installation directory and restrict write access to SYSTEM and Administrators.
Verify the integrity of existing BenimPOS binaries against known-good hashes and reinstall from a trusted source if tampering is suspected.
Restrict interactive local access to the systems running BenimPOS to reduce the pool of potential local attackers.

Patch Information

No vendor advisory or patched version is referenced in the NVD entry at the time of publication. Consult the GitHub CVE-2025-57392 Details reference and the vendor directly for remediation status. Until a fixed release is available, apply the ACL hardening described below.

Workarounds

Manually reset directory ACLs on the BenimPOS install path so that only administrative principals hold write and modify rights.
Deploy application allowlisting through Windows Defender Application Control or AppLocker to block execution of unsigned or modified BenimPOS binaries.
Run BenimPOS only under dedicated low-privilege accounts to limit the impact of a successful binary swap.

bash

# Reset ACLs on the BenimPOS installation directory (run as Administrator)
icacls "C:\Program Files\BenimPOS" /remove:g "Everyone"
icacls "C:\Program Files\BenimPOS" /remove:g "BUILTIN\Users"
icacls "C:\Program Files\BenimPOS" /inheritance:r
icacls "C:\Program Files\BenimPOS" /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "BUILTIN\Users:(OI)(CI)RX"