jvndb - jvndb-2025-000008

jvndb-2025-000008

Vulnerability from jvndb

Published

2025-02-05 14:06

Modified

2025-02-05 14:06

Severity ?

8.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

Multiple vulnerabilities in Defense Platform Home Edition

Details

Defense Platform Home Edition provided by Humming Heads Inc. contains multiple vulnerabilities listed below. <ul><li>Improper handling of message in specific process (CWE-422) - CVE-2025-20094</li> <li>Execution with unnecessary privileges (CWE-250) - CVE-2025-22890</li> <li>Improper handling of message in specific process (CWE-422) - CVE-2025-22894</li> <li>Buffer overflow vulnerability in DeviceIoControl (CWE-120) - CVE-2025-23236</li> <li>NULL pointer dereference vulnerability in DeviceIoControl (CWE-476) - CVE-2025-24483</li> <li>Argument injection vulnerability in DPprd.sys and DPavd.sys (CWE-88) - CVE-2025-24845</li></ul> CVE-2025-20094, CVE-2025-22890, CVE-2025-22894, CVE-2025-23236, CVE-2025-24483 Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer. CVE-2025-24845 This vulnerability was reported to IPA under the Information Security Early Warning Partnership, and JPCERT/CC coordinated with the developer.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN66673020/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-20094
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-22890
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-22894
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-23236
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-24483
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-24845
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	Humming Heads Inc.	Defense Platform

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000008.html",
  "dc:date": "2025-02-05T14:06+09:00",
  "dcterms:issued": "2025-02-05T14:06+09:00",
  "dcterms:modified": "2025-02-05T14:06+09:00",
  "description": "Defense Platform Home Edition provided by Humming Heads Inc. contains multiple vulnerabilities listed below.\r\n\u003cul\u003e\u003cli\u003eImproper handling of message in specific process (CWE-422) - CVE-2025-20094\u003c/li\u003e\r\n\u003cli\u003eExecution with unnecessary privileges (CWE-250) - CVE-2025-22890\u003c/li\u003e\r\n\u003cli\u003eImproper handling of message in specific process (CWE-422) - CVE-2025-22894\u003c/li\u003e\r\n\u003cli\u003eBuffer overflow vulnerability in DeviceIoControl (CWE-120) - CVE-2025-23236\u003c/li\u003e\r\n\u003cli\u003eNULL pointer dereference vulnerability in DeviceIoControl (CWE-476) - CVE-2025-24483\u003c/li\u003e\r\n\u003cli\u003eArgument injection vulnerability in DPprd.sys and DPavd.sys (CWE-88) - CVE-2025-24845\u003c/li\u003e\u003c/ul\u003e\r\n\r\nCVE-2025-20094, CVE-2025-22890, CVE-2025-22894, CVE-2025-23236, CVE-2025-24483\r\nTaizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.\r\n\r\nCVE-2025-24845\r\nThis vulnerability was reported to IPA under the Information Security Early Warning Partnership, and JPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000008.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:humming_heads_defense_platform",
    "@product": "Defense Platform",
    "@vendor": "Humming Heads Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000008",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN66673020/index.html",
      "@id": "JVN#66673020",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-20094",
      "@id": "CVE-2025-20094",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-22890",
      "@id": "CVE-2025-22890",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-22894",
      "@id": "CVE-2025-22894",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-23236",
      "@id": "CVE-2025-23236",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-24483",
      "@id": "CVE-2025-24483",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-24845",
      "@id": "CVE-2025-24845",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in Defense Platform Home Edition"
}

cve-2025-22890

Vulnerability from cvelistv5

Published

2025-02-06 07:05

Modified

2025-02-12 19:41

Severity ?

6.5 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Summary

Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained.

References

▼	URL	Tags
	https://www.hummingheads.co.jp/dep/storelist/
	https://jvn.jp/en/jp/JVN66673020/

Impacted products

	Vendor	Product	Version
	Humming Heads Inc.	Defense Platform Home Edition	Version: Ver.3.9.51.x and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T14:16:04.400324Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:41:05.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Defense Platform Home Edition",
          "vendor": "Humming Heads Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.3.9.51.x and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "Execution with Unnecessary Privileges",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T07:05:20.725Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.hummingheads.co.jp/dep/storelist/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN66673020/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-22890",
    "datePublished": "2025-02-06T07:05:20.725Z",
    "dateReserved": "2025-01-27T06:02:38.036Z",
    "dateUpdated": "2025-02-12T19:41:05.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2025-24483

Vulnerability from cvelistv5

Published

2025-02-06 07:05

Modified

2025-02-12 19:51

Severity ?

6.5 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Summary

NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition.

References

▼	URL	Tags
	https://www.hummingheads.co.jp/dep/storelist/
	https://jvn.jp/en/jp/JVN66673020/

Impacted products

	Vendor	Product	Version
	Humming Heads Inc.	Defense Platform Home Edition	Version: Ver.3.9.51.x and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24483",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T14:11:46.056172Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:51:10.698Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Defense Platform Home Edition",
          "vendor": "Humming Heads Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.3.9.51.x and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL pointer dereference",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T07:05:56.408Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.hummingheads.co.jp/dep/storelist/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN66673020/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-24483",
    "datePublished": "2025-02-06T07:05:56.408Z",
    "dateReserved": "2025-01-27T06:02:36.061Z",
    "dateUpdated": "2025-02-12T19:51:10.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2025-23236

Vulnerability from cvelistv5

Published

2025-02-06 07:05

Modified

2025-02-12 19:51

Severity ?

8.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained.

References

▼	URL	Tags
	https://www.hummingheads.co.jp/dep/storelist/
	https://jvn.jp/en/jp/JVN66673020/

Impacted products

	Vendor	Product	Version
	Humming Heads Inc.	Defense Platform Home Edition	Version: Ver.3.9.51.x and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-23236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T14:11:55.693467Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:51:10.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Defense Platform Home Edition",
          "vendor": "Humming Heads Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.3.9.51.x and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "Buffer overflow",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T07:05:49.056Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.hummingheads.co.jp/dep/storelist/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN66673020/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-23236",
    "datePublished": "2025-02-06T07:05:49.056Z",
    "dateReserved": "2025-01-27T06:02:36.857Z",
    "dateUpdated": "2025-02-12T19:51:10.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2025-20094

Vulnerability from cvelistv5

Published

2025-02-06 07:05

Modified

2025-02-12 19:51

Severity ?

8.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege.

References

▼	URL	Tags
	https://www.hummingheads.co.jp/dep/storelist/
	https://jvn.jp/en/jp/JVN66673020/

Impacted products

	Vendor	Product	Version
	Humming Heads Inc.	Defense Platform Home Edition	Version: Ver.3.9.51.x and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20094",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T14:12:17.311375Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:51:10.926Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Defense Platform Home Edition",
          "vendor": "Humming Heads Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.3.9.51.x and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unprotected Windows messaging channel (\u0027Shatter\u0027) issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-422",
              "description": "Unprotected Windows Messaging Channel (\u0027Shatter\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T07:05:41.254Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.hummingheads.co.jp/dep/storelist/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN66673020/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-20094",
    "datePublished": "2025-02-06T07:05:41.254Z",
    "dateReserved": "2025-01-27T06:02:31.382Z",
    "dateUpdated": "2025-02-12T19:51:10.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2025-24845

Vulnerability from cvelistv5

Published

2025-02-06 07:06

Modified

2025-02-12 19:51

Severity ?

6.3 (Medium) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Summary

Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition.

References

▼	URL	Tags
	https://www.hummingheads.co.jp/dep/storelist/
	https://jvn.jp/en/jp/JVN66673020/

Impacted products

	Vendor	Product	Version
	Humming Heads Inc.	Defense Platform Home Edition	Version: Ver.3.9.51.x and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T13:59:37.059053Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:51:10.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Defense Platform Home Edition",
          "vendor": "Humming Heads Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.3.9.51.x and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper neutralization of argument delimiters in a command (\u0027Argument Injection\u0027) issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "Improper neutralization of argument delimiters in a command (\u0027Argument Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T07:06:05.293Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.hummingheads.co.jp/dep/storelist/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN66673020/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-24845",
    "datePublished": "2025-02-06T07:06:05.293Z",
    "dateReserved": "2025-01-27T06:02:34.309Z",
    "dateUpdated": "2025-02-12T19:51:10.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2025-22894

Vulnerability from cvelistv5

Published

2025-02-06 07:05

Modified

2025-02-12 19:41

Severity ?

6.5 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Summary

References

▼	URL	Tags
	https://www.hummingheads.co.jp/dep/storelist/
	https://jvn.jp/en/jp/JVN66673020/

Impacted products

	Vendor	Product	Version
	Humming Heads Inc.	Defense Platform Home Edition	Version: Ver.3.9.51.x and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22894",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T14:15:19.426989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:41:05.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Defense Platform Home Edition",
          "vendor": "Humming Heads Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.3.9.51.x and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unprotected Windows messaging channel (\u0027Shatter\u0027) issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary files in the system may be altered. As a result, an arbitrary DLL may be executed with SYSTEM privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-422",
              "description": "Unprotected Windows Messaging Channel (\u0027Shatter\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-06T07:05:27.454Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.hummingheads.co.jp/dep/storelist/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN66673020/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-22894",
    "datePublished": "2025-02-06T07:05:27.454Z",
    "dateReserved": "2025-01-27T06:02:35.087Z",
    "dateUpdated": "2025-02-12T19:41:05.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

jvndb-2025-000008

Vulnerability from jvndb

cve-2025-22890

Vulnerability from cvelistv5

cve-2025-24483

Vulnerability from cvelistv5

cve-2025-23236

Vulnerability from cvelistv5

cve-2025-20094

Vulnerability from cvelistv5

cve-2025-24845

Vulnerability from cvelistv5

cve-2025-22894

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature