CVE-2025-30248 is a DLL hijacking vulnerability classified under CWE-427 that affects the WD Discovery Installer version 5.2.730 on Windows platforms. DLL hijacking occurs when an application loads dynamic link libraries from insecure or predictable locations, allowing an attacker to place a crafted DLL that the application will load instead of the legitimate one. In this case, the WD Discovery Installer searches for DLLs in its installation path or other directories that can be influenced by a local attacker. By placing a malicious DLL in one of these directories, an attacker with local access can cause the installer to execute arbitrary code with the privileges of the installer process. The vulnerability requires user interaction, specifically running the installer, and local access to the system. The CVSS 4.0 vector indicates no privileges are required (PR:N), but user interaction is necessary (UI:A), and the attack complexity is high (AC:H), suggesting some difficulty in exploitation. The impact covers confidentiality, integrity, and availability, as arbitrary code execution can lead to full system compromise. No patches or exploits are currently publicly available, but the vulnerability is published and should be addressed promptly. The vulnerability affects Windows users of WD Discovery, a software commonly used to manage Western Digital storage devices.

For European organizations, this vulnerability poses a significant risk, especially in environments where WD Discovery is widely deployed on Windows endpoints. Successful exploitation could allow attackers to execute arbitrary code locally, potentially leading to privilege escalation, data theft, or disruption of services. This is particularly concerning in enterprises with shared or multi-user systems where local access may be easier to obtain, such as in office environments or public workstations. The compromise of WD Discovery could also serve as a foothold for lateral movement within corporate networks. Given the high CVSS score and the broad impact on confidentiality, integrity, and availability, organizations could face operational disruptions, data breaches, and compliance issues under GDPR if sensitive data is exposed. The lack of known exploits in the wild reduces immediate risk but does not diminish the urgency of mitigation due to the potential severity.

1. Immediately audit all Windows systems for the presence of WD Discovery version 5.2.730 and earlier. 2. Restrict write permissions on directories involved in the installer's DLL search path to prevent unauthorized DLL placement. 3. Implement application whitelisting and code integrity policies (e.g., Windows Defender Application Control) to block execution of unauthorized DLLs. 4. Educate users to avoid running installers from untrusted sources and to verify software authenticity. 5. Monitor systems for unusual DLL loading behavior or unexpected installer activity using endpoint detection and response (EDR) tools. 6. Coordinate with Western Digital for timely patch releases and apply updates as soon as they become available. 7. Consider deploying the installer in a controlled environment or using elevated privilege restrictions to limit exploitation scope. 8. Regularly review and harden local user permissions to minimize the risk of local privilege escalation.