Read the docs
TI-2025-08498 Aliases CVE-2025-9267GHSA-6rrf-p74p-p7q8

Untrusted search path in Seagate Toolkit

Priority LOW 32CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current working directory without validating their origin or integrity. This behavior can be exploited by placing a malicious DLL in the same directory as the installer executable, leading to arbitrary code execution with the privileges of the user running the installer. The issue stems from the use of insecure DLL loading practices, such as relying on relative paths or failing to specify fully qualified paths when invoking system libraries.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00253 16th percentileScored 2026-11-07
Fix Fixed Toolkit (Seagate): 2.35.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SeagateToolkitbefore 2.35.0.62.35.0.6Patch availableCNA
  • Toolkit VendorSeagate Affected before 2.35.0.6 Fixed in 2.35.0.6 Patch available CNA

Remediation

  • Fix · CNA Toolkit (Seagate) Fixed in 2.35.0.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9267
  2. 2026-10-03 Alias added: GHSA-6rrf-p74p-p7q8

References

Other 2

  • TI-2018-03886 Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in… CVSS 3.0CRITICAL 9.8
  • TI-2014-02569 Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session… CVSS 3.0CRITICAL 9.8
  • TI-2014-07137 Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2020-05453 The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and… CVSS 3.1CRITICAL 9.8
  • TI-2013-05688 Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2012-02227 d41d8cd98f00b204e9800998ecf8427e.php in the management web server on the Seagate… CVSS 2.0HIGH 10.0
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences