CVE-2025-69875
LPE in Quickheal Total Security 23.0.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-69875 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Quickheal Total Security. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-16 (Security and Privacy Attributes) and AC-2 (Account Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-69875 is a vulnerability in Quick Heal Total Security version 23.0.0, specifically within the quarantine management component. It stems from insufficient validation of restore paths combined with improper permission handling, enabling a low-privileged local user to restore quarantined files directly into protected system directories. This flaw, associated with CWEs-269 (Improper Privilege Management), CWE-281 (Improper Preservation of Permissions), and CWE-552 (Files or Directories Accessible to External Parties), carries a CVSS v3.1 base score of 7.8 (High), reflecting local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited by a low-privileged local attacker who gains access to the system. By abusing the quarantine restore functionality, the attacker can place arbitrary files into high-privilege system locations that would otherwise be restricted, potentially achieving privilege escalation to higher levels such as administrator or SYSTEM. No user interaction is needed beyond local access, making it straightforward for compromised standard user accounts to elevate privileges and further compromise the host.
References include a GitHub repository at https://github.com/mertdas/QuickHealTotalSecurityPOC, which provides a proof-of-concept for the issue, and a product security update page from Samsung Semiconductor at https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-59439/. No specific patch or mitigation details are detailed in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206708
Vulnerability Data
A vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component where insufficient validation of restore paths and improper permission handling allow a low-privileged local user to restore quarantined files into protected system directories. This behavior can…
more
be abused by a local attacker to place files in high-privilege locations, potentially leading to privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 18 hardening rules · 7 OS baselines
V8.4.2
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly enforces authorization checks on access to files and directories, stopping unauthorized external exposure.
Associating and preserving security attributes (including permissions) with objects reduces the chance they are lost or weakened on copy/restore/share.
Account management directly governs assignment and tracking of privileges so proper implementation stops the weakness from being introduced.
Requiring explicit access-control decisions ensures privileges are evaluated rather than assumed or omitted.
Separation of duties constrains how privileges may be assigned, reducing the chance of overly broad actor control.
Least privilege is the direct countermeasure to improper privilege management; implementing it eliminates the root cause.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-05 enforces least privilege/SoD and periodic reviews that directly remove most privilege-assignment defects, yet CWE-269 also covers escalation paths and role design outside a single access-management control.
Logical segmentation and access protections stop external parties from reaching files that should remain internal.
PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.
Data-at-rest protections such as encryption or ACLs reduce the impact of unintended file exposure.
Config baselines and default reviews can enforce some privilege-related settings (one facet) but do not address code-level assignment/tracking logic that defines CWE-269.
PR.PS-05 can partially limit exploitability of some privilege issues via execution restrictions, but does not address the core design/implementation flaws of CWE-269 at all.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring owner approval, segregation of duties, and periodic reviews prevents the assignment of excessive or unnecessary privileges to users or processes.
Enforcing minimum-necessary privileges, temporary grants, and separation of administrative versus normal identities prevents the over-assignment of rights that CWE-269 describes.
Dynamic techniques that grant the minimum necessary rights for a given time window and revoke them afterward reduce the window in which excessive or unnecessary privileges can be exploited.
By tracing and retrieving all copies of information stored on endpoint and portable devices, the control reduces the likelihood that files remain accessible outside the organization’s security perimeter.
Labeling information according to its sensitivity and specifying corresponding protection measures makes it less probable that files or directories containing sensitive content will be left accessible to external parties.
Explicit restrictions on privileged access and segregation of duties limit the scope of privileges that can be assigned, reducing the chance that excessive or unnecessary privileges are granted to entities.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248579 OL 8 must restrict access to the kernel message buffer. prevents CWE-552
- V-248597 There must be no "shosts.equiv" files on the OL 8 operating system. prevents CWE-552
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-269
Windows 11 (1 rule)
- V-253269 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-269
Windows Server 2016 (1 rule)
- V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. prevents CWE-269
Windows Server 2019 (2 rules)
- V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-281
- V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-269
Windows Server 2022 (3 rules)
- V-254428 Windows Server 2022 must only allow administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-269
- V-254393 Windows Server 2022 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-281
- V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-281