{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-17T05:29:27.002","vulnerabilities":[{"cve":{"id":"CVE-2025-61037","sourceIdentifier":"cve@mitre.org","published":"2025-12-31T16:15:43.727","lastModified":"2026-01-14T20:29:48.850","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The flaw is a Time-of-Check Time-of-Use (TOCTOU) race condition in the license management logic. The regService process, which runs with SYSTEM privileges, creates a fixed directory and writes files without verifying whether the path is an NTFS reparse point. By exploiting this race condition, an attacker can replace the target directory with a junction pointing to a user-controlled path. This causes the SYSTEM-level process to drop binaries in a location fully controlled by the attacker, allowing arbitrary code execution with SYSTEM privileges. The vulnerability can be exploited by any standard user with only a single UAC confirmation, making it highly practical and dangerous in real-world environments."},{"lang":"es","value":"Existe una vulnerabilidad de escalada de privilegios local en SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). La falla es una condición de carrera de Tiempo de Verificación a Tiempo de Uso (TOCTOU) en la lógica de gestión de licencias. El proceso regService, que se ejecuta con privilegios de SYSTEM, crea un directorio fijo y escribe archivos sin verificar si la ruta es un punto de reanálisis NTFS. Al explotar esta condición de carrera, un atacante puede reemplazar el directorio de destino con una unión que apunta a una ruta controlada por el usuario. Esto hace que el proceso a nivel de SYSTEM coloque binarios en una ubicación totalmente controlada por el atacante, permitiendo la ejecución de código arbitrario con privilegios de SYSTEM. La vulnerabilidad puede ser explotada por cualquier usuario estándar con solo una única confirmación de UAC, lo que la hace altamente práctica y peligrosa en entornos del mundo real."}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sevencs:ec2007_kernel:5.22:*:*:*:*:*:*:*","matchCriteriaId":"1B7535E9-C8EB-41F7-A6A8-4698A33E4239"},{"vulnerable":true,"criteria":"cpe:2.3:a:sevencs:orca_g2:2.0.1.35:*:*:*:*:*:*:*","matchCriteriaId":"29199970-680B-493F-BB24-F18DE15C1468"}]}]}],"references":[{"url":"https://gist.github.com/jc0818/233462416579661e4e2795f96457a6bf","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]}]}}]}