WellChoose｜BatchSignCS - Willkürliches Schreiben von Dateien durch Pfadüberspringung

The impact of this vulnerability is significant. An attacker can exploit it by crafting a malicious website that, when visited by a user with BatchSignCS running, triggers the arbitrary file write. This allows the attacker to overwrite critical system files, inject malicious code, or gain persistent access to the compromised system. The potential for arbitrary code execution means the attacker could achieve complete control over the affected machine, including data theft, privilege escalation, and lateral movement within the network. This vulnerability shares similarities with other file write vulnerabilities where attackers leverage user interaction to gain unauthorized access.

Organizations using BatchSignCS for code signing or digital signature workflows are at significant risk. Systems with limited user awareness and those exposed to untrusted websites are particularly vulnerable. Shared hosting environments where multiple users share the same system could also amplify the impact of this vulnerability.

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -eq "BatchSignCS"}

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='BatchSignCS']]]" -MaxEvents 10

• windows / supply-chain: Check Autoruns for unusual entries related to BatchSignCS. • windows / supply-chain: Monitor Windows Defender for alerts related to BatchSignCS and suspicious file write activity.

1. 2025-07-14Disclosure

   disclosure

1. Reserviert2025-07-14
2. Veröffentlicht2025-07-14
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-7619 is to immediately upgrade BatchSignCS to version 3.318.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. While a direct WAF rule is unlikely to be effective due to the nature of the vulnerability, monitoring network traffic for suspicious file write attempts to unusual locations could provide some early warning. Review BatchSignCS configuration to ensure it is running with the least privileges necessary. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known malicious payload and verifying that the file write is blocked.