Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be executed.

CVE-2025-35978 is a high-severity vulnerability affecting Fujitsu Client Computing Limited's UpdateNavi software, specifically versions V1.4 L10 through L33 and the UpdateNaviInstallService Service versions 1.2.0091 to 1.2.0125. The vulnerability arises from improper restriction of communication channels to intended endpoints within the UpdateNavi update mechanism. This flaw allows a local authenticated attacker to send crafted malicious data through these communication channels, which can lead to unauthorized modification of arbitrary registry values or execution of arbitrary code on the affected system. The vulnerability does not require user interaction but does require local authentication, meaning the attacker must have some level of access to the system. The CVSS v3.0 score is 7.1, reflecting a high severity due to the potential for integrity and availability impacts without compromising confidentiality. The exploitation vector is local (AV:L), with low attack complexity (AC:L), and privileges required are low (PR:L). The scope remains unchanged (S:U), indicating the vulnerability affects only the vulnerable component and does not extend to other system components. The lack of known exploits in the wild suggests this vulnerability has not yet been actively exploited, but the potential impact remains significant given the ability to execute arbitrary code and modify critical registry settings. The vulnerability is particularly concerning because registry modifications can persist across reboots and may be leveraged to establish persistence or disable security controls, while arbitrary code execution can lead to full system compromise within the privileges of the UpdateNavi service or user context. UpdateNavi is a utility used primarily on Fujitsu client computing devices to manage system updates, making this vulnerability relevant to organizations using Fujitsu hardware and software management tools.

Detailed information about CVE-2025-35978: Improper restriction of communication channel to intended endpoints in Fujitsu Client Computing Limited UpdateNavi af

CVE-2025-35978: Improper restriction of communication channel to intended endpoints in Fujitsu Client Computing Limited UpdateNavi - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'cve-2025-35978'

Filter Threats

Threats Tagged 'cve-2025-35978'