CVE-2025-57797: ScanSnap Manager Privilege Escalation

CVE-2025-57797 Overview

CVE-2025-57797 is an incorrect privilege assignment vulnerability [CWE-266] affecting ScanSnap Manager installers prior to version V6.5L61. The flaw allows an authenticated local attacker to escalate privileges and execute arbitrary commands on the affected host. The vulnerability is tracked under Japan Vulnerability Notes advisory JVN#69684540 and affects installer packages distributed by PFU (a Ricoh company) for ScanSnap document scanner devices.

Critical Impact
A local user with low privileges can leverage the flawed installer to obtain elevated rights and run arbitrary commands, resulting in full compromise of confidentiality, integrity, and availability on the affected system.

Affected Products

ScanSnap Manager installers prior to V6.5L61
PFU / Ricoh ScanSnap desktop software distributions bundling the affected installer
Windows endpoints running vulnerable ScanSnap Manager installations

Discovery Timeline

2025-08-27 - CVE-2025-57797 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57797

Vulnerability Analysis

CVE-2025-57797 stems from incorrect privilege assignment during ScanSnap Manager installation. The installer, which typically runs with elevated rights, assigns overly permissive access to files, directories, registry entries, or services that a standard user can subsequently modify. When those resources are later invoked in a privileged context, the attacker's controlled content is executed with elevated privileges.

This class of flaw is common in Windows installers that create program directories or scheduled tasks without restricting access control lists (ACLs) to administrative principals. The result is a durable local privilege escalation primitive that persists after installation completes.

Root Cause

The root cause is a design flaw categorized as [CWE-266] Incorrect Privilege Assignment. The installer grants privileges to resources beyond what is required for normal operation, violating the principle of least privilege. Standard users inherit write or modify rights over objects that execute or load in the context of SYSTEM or another privileged account.

Attack Vector

Exploitation requires local access and valid low-privileged credentials on the target host. No user interaction beyond attacker action is required. The attacker replaces or modifies a resource left writable by the vulnerable installer, then triggers the associated privileged process, service, or update routine. Execution occurs in the elevated security context, yielding arbitrary command execution.

Because the attack vector is local and requires authentication, remote exploitation over the network is not possible. However, the flaw is well suited to post-compromise lateral movement and persistence chains where an adversary already holds foothold credentials on a workstation running ScanSnap software.

Detection Methods for CVE-2025-57797

Indicators of Compromise

Unexpected file writes by non-administrative users into ScanSnap Manager installation directories under Program Files
Modification of ScanSnap-related executables, DLLs, or configuration files by standard user accounts
Child processes spawned by ScanSnap Manager services or scheduled tasks executing under SYSTEM with anomalous command lines

Detection Strategies

Audit filesystem and registry ACLs on ScanSnap Manager installation paths for entries granting write access to Users or Authenticated Users groups
Monitor process creation events (Windows Event ID 4688, Sysmon Event ID 1) where ScanSnap services launch unsigned or unexpected binaries
Alert on privilege elevation chains that originate from ScanSnap installer or updater components invoking cmd.exe, powershell.exe, or script interpreters

Monitoring Recommendations

Enable command-line auditing and Sysmon on endpoints running ScanSnap Manager to capture full execution telemetry
Correlate installer execution events with subsequent privileged process launches to identify exploitation attempts
Review endpoint detection and response (EDR) telemetry for standard-user modifications of files that are later loaded by privileged processes

How to Mitigate CVE-2025-57797

Immediate Actions Required

Upgrade ScanSnap Manager to version V6.5L61 or later on all affected endpoints
Inventory all systems running ScanSnap Manager and prioritize patching workstations accessible to non-administrative users
Review ACLs on existing ScanSnap installation directories and remove any excessive write permissions granted to standard users

Patch Information

PFU (Ricoh) has released V6.5L61 of ScanSnap Manager to remediate the incorrect privilege assignment. Refer to the JVN Security Advisory and the Ricoh Imaging News Release for vendor guidance. System requirements for the updated software are documented on the ScanSnap Software Requirements page.

Workarounds

Restrict interactive local logon on hosts running ScanSnap Manager to trusted administrative users until patching is complete
Manually harden ACLs on the ScanSnap Manager installation directory to remove write and modify permissions for non-administrative principals
Apply application allowlisting to prevent execution of unsigned binaries from ScanSnap installation paths

bash

# Configuration example: audit ACLs on the ScanSnap Manager install directory (PowerShell)
Get-Acl "C:\Program Files (x86)\PFU\ScanSnap" |
  Select-Object -ExpandProperty Access |
  Where-Object { $_.IdentityReference -match "Users|Authenticated Users" -and $_.FileSystemRights -match "Write|Modify|FullControl" }