CVE-2025-8070: Windows service registered with an unquoted ImagePath vulnerability in the system registry
The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the service runs with elevated privileges, exploitation results in privilege escalation to SYSTEM level. This vulnerability arises from an unquoted service path affecting systems where the executable resides in a path containing spaces. Affected products and versions include: ABP 2.0.7.6130 and earlier as well as AES 1.0.6.6133 and earlier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ABPto a version that resolves this vulnerability.Fixed in 2.0.7.6130 - Upgrade
Upgrade
AESto a version that resolves this vulnerability.Fixed in 1.0.6.6133 - Configuration
Update the ABP and AES Windows service configuration so the ImagePath registry value is properly quoted (e.g., includes quotes around the executable path). This prevents exploitation of an unquoted service path when the executable resides in a directory containing spaces (predictable locations like C:\Program.exe).
Windows service (ABP/AES) ImagePath (unquoted service path) = Quoted ImagePath - Compensating control
If the affected ABP/AES Windows service runs with elevated privileges, restrict local attacker ability (e.g., reduce/limit who can write to the predictable locations and who can influence the service context) to mitigate arbitrary code execution leading to SYSTEM-level privilege escalation.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8070?
CVE-2025-8070 has a high severity rating due to its potential to allow local attackers to execute arbitrary code.
How do I fix CVE-2025-8070?
To fix CVE-2025-8070, ensure that the Windows service configuration does not contain unquoted ImagePath registry values.
Who is affected by CVE-2025-8070?
CVE-2025-8070 affects versions of ABP up to 2.0.7.6130 and AES up to 1.0.6.6133.
What systems are at risk from CVE-2025-8070?
Systems running ABP and AES software with vulnerable versions are at risk from CVE-2025-8070.
Is there a patch available for CVE-2025-8070?
As of now, a specific patch for CVE-2025-8070 has not been detailed, so users should consult the vendor for updates.