Skip to content
Fencer Vulns
high 8.1

CVE-2025-43715 json

Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation…

published 2025-04-17 18 mo ago modified 2026-10-15 25 d ago also EUVD-2025-11523

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.

Patch / fix

  • Nullsoft Nullsoft Scriptable Install System 3.11
  • Siemens SIMATIC Technology Package TPCamGen V1.3.1
  • nsis Debian 14, Debian 13 3.11-1

debian advisories DEBIAN-CVE-2025-43715

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-254-01 updated cvss 8.1

Siemens SIMOTION Tools

  • Siemens SIMATIC Technology Package TPCamGen (6ES7823-0FE30-1AA0)
    affected: mitigation, no fix available
  • Siemens SIMOTION OA MIIF (6AU1820-3DA20-0AB0) Siemens SIMOTION OACAMGEN (6AU1820-3EA20-0AB0) Siemens SIMOTION OALECO (6AU1820-3HA20-0AB0) Siemens SIMOTION OAVIBX (6AU1820-3CA20-0AB0)
    affected: mitigation, no fix planned

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Nullsoft Nullsoft Scriptable Install System
  • Siemens SIMATIC Technology Package TPCamGen
  • Siemens SIMOTION OA MIIF
  • Siemens SIMOTION OACAMGEN
  • Siemens SIMOTION OALECO
  • Siemens SIMOTION OAVIBX

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.