Skip to content
OpenAdvisories
High · 7.0 Public exploit CVE-2025-9267 EUVD-2025-31342GHSA-6rrf-p74p-p7q8

In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs fro…

Published Sep 26, 2025 · Updated Sep 29, 2025 · Assigned by Seagate

Vendor: Seagate Product: Toolkit

Description

In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current working directory without validating their origin or integrity. This behavior can be exploited by placing a malicious DLL in the same directory as the installer executable, leading to arbitrary code execution with the privileges of the user running the installer. The issue stems from the use of insecure DLL loading practices, such as relying on relative paths or failing to specify fully qualified paths when invoking system libraries.

Affected products

VendorProductAffectedFixed
Seagate Toolkit < 2.35.0.6 2.35.0.6

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Tiger3080/CVE-2025-9267 ★ 0 · Sep 29, 2025

    Seagate Toolkit for Windows (Installer <2.35.0.6) is vulnerable to insecure DLL loading. The installer loads DLLs from the working directory without validation, allowing attackers to place a maliciou…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References