TI-2025-40893 Aliases CVE-2025-66461 GHSA-8jwj-hrwc-5589

FULLBACK Manager Pro provided by GS Yuasa International Ltd.

LOW 37CWE-428Published 2025-12-08 · Updated 2025-12-08

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-428.

Summary

FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute arbitrary code with SYSTEM privilege if he/she has the write permission on the path to the directory where the affected product is installed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00155 4th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GS Yuasa International Ltd.	FULLBACK Manager Pro (for Windows)	up to 4.00	—	No fix listed	CNA
GS Yuasa International Ltd.	FULLBACK Manager Pro for Network (for Windows)	up to 3.00	—	No fix listed	CNA

FULLBACK Manager Pro (for Windows) VendorGS Yuasa International Ltd. Affected up to 4.00 Fixed in — No fix listed CNA
FULLBACK Manager Pro for Network (for Windows) VendorGS Yuasa International Ltd. Affected up to 3.00 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-66461
2026-10-03 Alias added: GHSA-8jwj-hrwc-5589

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences