« Volver al listado

CVE-2025-34109

Estado: AplazadaAlta (8.5)—

PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016 (all versions up to 16.1.2).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local con privilegios bajos (AV:L/PR:L) que logra ejecución SYSTEM mediante DLL hijacking en directorio escribible. CWE-427 (Uncontrolled Search Path Element) confirma T1574.007.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionAuditThreat Intelligence ProgramRestrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account Management

Tecnologías afectadas (4)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pandasecurity — Antivirus PROAIPandasecurity — Global ProtectionAIPandasecurity — Internet SecurityAIPandasecurity — Small Business ProtectionAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-34109",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-34109",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-15T13:36:33.822082Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Panda Security",
          "modules": [
            "PSEvents.exe"
          ],
          "product": "Panda Global Protection 2016",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "16.1.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Panda Security",
          "modules": [
            "PSEvents.exe"
          ],
          "product": "Panda Antivirus Pro 2016",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "16.1.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Panda Security",
          "modules": [
            "PSEvents.exe"
          ],
          "product": "Panda Small Business Protection",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "16.1.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Panda Security",
          "modules": [
            "PSEvents.exe"
          ],
          "product": "Panda Internet Security 2016",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "16.1.2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-15T13:15:30.683",
  "references": [
    {
      "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/local/panda_psevents.rb",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://web.archive.org/web/20160704105329/http://www.pandasecurity.com/uk/support/card?id=100053",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://web.archive.org/web/20170415211828/http://www.security-assessment.com/files/documents/advisory/Panda%20Security%20-%20Privilege%20Escalation.pdf",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40020",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/panda-security-psevents-insecure-dll-loading-privilege-escalation",
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016 (all versions up to 16.1.2)."
    },
    {
      "lang": "es",
      "value": "PSEvents.exe, en varios productos de Panda Security, se ejecuta cada hora con privilegios de SYSTEM y carga archivos DLL desde un directorio de escritura del usuario sin la validación adecuada. Un atacante con acceso limitado, capaz de escribir archivos DLL en el directorio monitorizado, puede ejecutar código arbitrario con privilegios de SYSTEM. Los productos afectados incluyen Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection y Panda Internet Security 2016 (todas las versiones hasta la 16.1.2)."
    }
  ],
  "lastModified": "2026-06-17T09:13:28.947",
  "sourceIdentifier": "disclosure@vulncheck.com"
}