BUFFALO NAS Navigator2 Unquoted Service Path Vulnerability on Windows
Vulnerability
A vulnerability exists in the Windows version of NAS Navigator2 by BUFFALO INC., prior to version 3.12.0, where a Windows service is registered with an unquoted file path. This flaw allows users with write permissions on the root directory of the system drive to execute arbitrary code with SYSTEM privileges.
Impact
Exploitation of this vulnerability could lead to arbitrary code execution with SYSTEM privileges on the affected Windows machine.
Remediation
Users are advised to update NAS Navigator2 for Windows to the latest version, 3.12.0 or later.
Added: Oct 10, 2025, 5:17 AM
Updated: Oct 10, 2025, 5:17 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
3.3remediation
7.7relevance
0.7threat
0.0urgency
2.9incentive
0.8Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.