VulnerabilityDeferred

CVE-2025-45095

Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCIService.exe service with an unquoted service path vulnerability.

HIGH 7.3EPSS 0.29%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCIService.exe service with an unquoted service path vulnerability. An attacker with write access to the file system could potentially execute arbitrary code with elevated privileges by placing a malicious executable in the unquoted path.

CVSS 3.1: 7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-284
Source: cve@mitre.org

References

https://gist.github.com/T4rantell/cd73592950c4ac700b40cc8e8e36494d

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.