CVE-2025-43715

EUVD-2025-11523
Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.41%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
SiemensSIMATIC Technology Package TPCamGen
𝑥
< V1.3.1
ADP
SiemensSIMOTION OA MIIF
𝑥
< *
ADP
SiemensSIMOTION OACAMGEN
𝑥
< *
ADP
SiemensSIMOTION OALECO
𝑥
< *
ADP
SiemensSIMOTION OAVIBX
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
nsis
bookworm
no-dsa
bullseye
postponed
forky
3.12-1
fixed
sid
3.12-1
fixed
trixie
3.11-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nsis
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
ignored
questing
ignored
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://nsis.sourceforge.io/Docs/AppendixF.html#v3.11-rl
https://sourceforge.net/p/nsis/bugs/1315/
https://cert-portal.siemens.com/productcert/html/ssa-563922.html