Shanghai Bairui Information Technology SunloginClient 15.8.3.19819 sunlogin_guard.exe uncontrolled search path

Summaryinfo

A vulnerability marked as problematic has been reported in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in the library process.dll of the file sunlogin_guard.exe. Performing a manipulation results in uncontrolled search path. This vulnerability is reported as CVE-2025-4532. The attack requires a local approach. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown code in the library process.dll of the file sunlogin_guard.exe. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared at yuque.com. This vulnerability is uniquely identified as CVE-2025-4532. The exploitability is told to be difficult. An attack has to be approached locally. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1574 for this issue.

The exploit is shared for download at yuque.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Shanghai Bairui Information Technology

Name

• SunloginClient

Version

• 15.8.3.19819

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #566141: Shanghai Bairui Information Technology Co., Ltd SunloginClient 15.8.3.19819 privilege escalation (by Ba1_Ma0)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion