CVE-2025-57846 Overview
CVE-2025-57846 affects multiple i-フィルター (i-Filter) products from Digital Arts Inc. (DAJ). The vulnerability stems from incorrect default permissions [CWE-276] assigned to service executable files installed by the product. A local authenticated attacker can replace the service executable on a system running the product. When the service starts, the substituted binary executes with SYSTEM privileges, granting full control of the affected host.
Critical Impact
A local authenticated attacker can achieve arbitrary code execution with SYSTEM privileges by replacing an i-フィルター service executable.
Affected Products
- Multiple i-フィルター (i-Filter) products from Digital Arts Inc.
- See the JVN #55678602 Advisory for the specific product list and version ranges
- Refer to the vendor bulletins DAJ Information Report 2025-1 and DAJ Information Report 2025-2
Discovery Timeline
- 2025-08-27 - CVE-2025-57846 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-57846
Vulnerability Analysis
CVE-2025-57846 is an insecure permissions flaw classified under [CWE-276] Incorrect Default Permissions. During installation, the i-フィルター product places service executables in a location where non-administrative local users hold write access. Windows services associated with the product typically run under the LocalSystem account. When a low-privileged user overwrites the service binary with attacker-controlled code, the Service Control Manager launches that binary with SYSTEM privileges at the next service start or system reboot.
This vulnerability requires local access and valid credentials on the target host. User interaction is not required. Exploitation results in complete confidentiality, integrity, and availability compromise of the endpoint. It provides a reliable local privilege escalation primitive for attackers who have already achieved initial access through phishing, credential theft, or another initial vector.
Root Cause
The installer sets access control lists (ACLs) on the service executable or its parent directory that grant write or modify rights to standard users. Correct hardening requires that only Administrators, SYSTEM, and TrustedInstaller retain modification rights on files launched by privileged services.
Attack Vector
Exploitation follows a standard binary planting sequence. The attacker authenticates locally, overwrites the vulnerable service executable with a malicious binary, and triggers a service restart or waits for reboot. The Service Control Manager then executes the attacker's payload as SYSTEM. No user interaction and no additional exploitation primitives are required.
No verified exploit code is publicly available for CVE-2025-57846. Refer to the JVN #55678602 Advisory for vendor-supplied technical details.
Detection Methods for CVE-2025-57846
Indicators of Compromise
- Unexpected modification timestamps on i-フィルター service executables or their installation directory
- Creation of new files or renamed binaries in the i-フィルター install path by non-administrative accounts
- Windows services associated with i-フィルター spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe
- Event Log entries showing service binary changes or unexpected service restarts
Detection Strategies
- Monitor file integrity on the i-フィルター installation directory and alert on write operations from non-privileged security identifiers
- Correlate Windows Event ID 7045 (service installed) and 7040 (service configuration changed) with the i-フィルター service name
- Baseline the parent-child process relationships of i-フィルター services and alert on deviations
Monitoring Recommendations
- Enable Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime changed) for the product install path
- Ingest endpoint telemetry into a centralized data lake to hunt for service-binary tampering across the fleet
- Audit ACLs on the i-フィルター install path periodically and flag directories where Users or Authenticated Users groups hold write access
How to Mitigate CVE-2025-57846
Immediate Actions Required
- Apply the vendor-supplied updates referenced in the JVN #55678602 Advisory and the DAJ information reports
- Inventory all endpoints running i-フィルター products and prioritize patching hosts with interactive local users
- Restrict interactive logon on systems running the product to reduce the pool of accounts that can exploit the flaw
Patch Information
Digital Arts Inc. has published fixes and guidance in the DAJ Information Report 2025-1 and DAJ Information Report 2025-2. Administrators should consult these bulletins for the exact fixed versions matching their deployed product edition.
Workarounds
- Manually correct the ACLs on the i-フィルター installation directory so that only Administrators, SYSTEM, and TrustedInstaller retain write and modify rights
- Enforce application allowlisting to prevent unauthorized binaries from executing under the service account
- Limit local logon rights and remove standard users from any group that permits writing to C:\Program Files subdirectories used by the product
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
