Description
Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| I-O DATA DEVICE | NarSuS App | prior to Ver.2.33 | — |
| I-O DATA DEVICE | Clone for Windows | prior to Ver2.36 | — |