CVE-2025-58097: LogStare Collector Privilege Escalation

CVE-2025-58097 Overview

CVE-2025-58097 affects LogStare Collector, a log collection product from Secuavail. The installation directory ships with incorrect access permissions, allowing non-administrative users to modify files within it. Because the affected files run with administrative privileges, a local low-privileged user can replace or manipulate binaries and executables to run arbitrary code as an administrator. The weakness is classified under CWE-276: Incorrect Default Permissions and enables local privilege escalation on both Windows and Linux installations of the affected software.

Critical Impact
A local, authenticated user with standard privileges can achieve arbitrary code execution with administrative rights by tampering with files inside the LogStare Collector installation directory.

Affected Products

Secuavail LogStare Collector (all versions prior to the vendor fix)
Microsoft Windows installations of LogStare Collector
Linux installations of LogStare Collector

Discovery Timeline

2025-11-21 - CVE-2025-58097 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58097

Vulnerability Analysis

The vulnerability stems from the LogStare Collector installer creating its installation directory with permissive access control lists. Standard, non-administrative users on the host inherit write access to files and executables placed under this directory. Because LogStare Collector components are executed with administrative privileges (for example, as a Windows service or a privileged Linux daemon), any file a low-privileged user can overwrite becomes an execution primitive.

An attacker with an existing foothold as a normal user can replace a binary, library, script, or configuration file within the installation directory. When the LogStare Collector process next loads or executes the tampered file, the attacker's code runs with administrative privileges. The impact is limited to integrity, but that integrity impact directly yields a full local privilege escalation on the affected host.

Root Cause

The root cause is CWE-276: Incorrect Default Permissions. During installation, LogStare Collector does not restrict the installation directory's access control lists to administrators and the service account. Instead, standard users retain write permissions on files that are later executed by a privileged process.

Attack Vector

Exploitation requires local access and low-privileged authenticated user context. No user interaction is required. The attacker overwrites or plants a file in the installation directory, then waits for or triggers execution by the privileged LogStare Collector process. Successful exploitation results in code execution under the administrative account that runs the service.

No public proof-of-concept exploit is available for CVE-2025-58097 at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the JVN Security Advisory JVN#77560819 and the Logstare Vulnerability Report 2025-001 for vendor technical details.

Detection Methods for CVE-2025-58097

Indicators of Compromise

Unexpected modifications to executables, DLLs, shared objects, or scripts within the LogStare Collector installation directory.
New or replaced files in the installation directory owned by a non-administrative user account.
LogStare Collector service or daemon spawning unusual child processes such as command shells, script interpreters, or network utilities.

Detection Strategies

Baseline the contents of the LogStare Collector installation directory and alert on file writes performed by non-administrative accounts.
Monitor process ancestry for children of the LogStare Collector service that fall outside the expected set of executables.
Correlate low-privileged user file-write events with subsequent execution under the LogStare Collector service account.

Monitoring Recommendations

Enable file integrity monitoring on the LogStare Collector installation directory across Windows and Linux hosts.
Collect and centralize Windows Security event ID 4663 (object access) and Linux auditdPATH/SYSCALL events for the installation path.
Review LogStare Collector service logs for unexpected restarts, configuration reloads, or module load failures that may indicate tampering.

How to Mitigate CVE-2025-58097

Immediate Actions Required

Upgrade LogStare Collector to the fixed version referenced in the Logstare Vulnerability Report 2025-001.
Audit the installation directory ACLs on every host running LogStare Collector and remove write permissions for non-administrative users and groups.
Enumerate local accounts on affected hosts and validate that no low-privileged user has planted files under the installation path.

Patch Information

Secuavail has published remediation guidance in the Logstare Vulnerability Report 2025-001. Administrators should apply the vendor-supplied update, which corrects the installation directory permissions. Coordinated disclosure details are also available in the JVN Security Advisory JVN#77560819.

Workarounds

On Windows, restrict the installation directory ACL to Administrators, SYSTEM, and the service account only, removing Users and Authenticated Users write entries.
On Linux, set ownership of the installation directory to root and apply chmod -R go-w to remove group and world write permissions.
Restrict interactive local logon on LogStare Collector hosts to administrators until the vendor patch is applied.

bash

# Configuration example: harden the LogStare Collector installation directory

# Windows (run as Administrator)
icacls "C:\Program Files\LogStare\Collector" /inheritance:r
icacls "C:\Program Files\LogStare\Collector" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\LogStare\Collector" /remove "Users" "Authenticated Users"

# Linux (run as root)
chown -R root:root /opt/logstare/collector
chmod -R go-w /opt/logstare/collector
find /opt/logstare/collector -type f -perm -o+w -exec chmod o-w {} \;