fkie_nvd - fkie_cve-2025-26698

FKIE_CVE-2025-26698

Vulnerability from fkie_nvd - Published: 2025-02-26 13:15 - Updated: 2025-02-26 13:15

Severity ?

2.7 (Low) - CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

Summary

Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system where using the product.

References

	URL	Tags
	vultures@jpcert.or.jp	https://jscom.jp/news-20250217/
	vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN91300609/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system where using the product."
    },
    {
      "lang": "es",
      "value": "Existe un problema de transferencia incorrecta de recursos entre esferas en RevoWorks SCVX y RevoWorks Browser. Si se explota esta vulnerabilidad, se pueden descargar archivos maliciosos en el sistema en el que se utiliza el producto."
    }
  ],
  "id": "CVE-2025-26698",
  "lastModified": "2025-02-26T13:15:41.983",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 1.4,
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-02-26T13:15:41.983",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jscom.jp/news-20250217/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "url": "https://jvn.jp/en/jp/JVN91300609/"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-669"
        }
      ],
      "source": "vultures@jpcert.or.jp",
      "type": "Secondary"
    }
  ]
}

CVE-2025-26698 (GCVE-0-2025-26698)

Vulnerability from cvelistv5 – Published: 2025-02-26 08:42 – Updated: 2025-02-26 15:32

Summary

Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system where using the product.

Severity ?

2.7 (Low)


                        
                          CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

CWE

CWE-669 - Incorrect resource transfer between spheres

Assigner

jpcert

References

URL

Tags

	https://jscom.jp/news-20250217/
	https://jvn.jp/en/jp/JVN91300609/

Impacted products

Vendor

Product

Version

J’s Communication Co., Ltd.

RevoWorks SCVX

Affected: 4.0.234 and earlier 4 series versions
Affected: 5.0.7 and earlier 5 series versions

J’s Communication Co., Ltd.

RevoWorks Browser

Affected: 2.2.100 and earlier 2 series versions
Affected: 3.0.1 and earlier 3 series versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26698",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T14:46:43.527797Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-26T15:32:14.346Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RevoWorks SCVX",
          "vendor": "J\u2019s Communication Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.234 and earlier 4 series versions"
            },
            {
              "status": "affected",
              "version": "5.0.7 and earlier 5 series versions"
            }
          ]
        },
        {
          "product": "RevoWorks Browser",
          "vendor": "J\u2019s Communication Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.100 and earlier 2 series versions"
            },
            {
              "status": "affected",
              "version": "3.0.1 and earlier 3 series versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system where using the product."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-669",
              "description": "Incorrect resource transfer between spheres",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-26T08:42:53.924Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://jscom.jp/news-20250217/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN91300609/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-26698",
    "datePublished": "2025-02-26T08:42:53.924Z",
    "dateReserved": "2025-02-14T04:32:33.696Z",
    "dateUpdated": "2025-02-26T15:32:14.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2025-26698

CVE-2025-26698 (GCVE-0-2025-26698)

Tags

Sightings

Nomenclature