Yamaha YMS-VPN8: Unquoted service path allows privilege escalation
Summary
YMS-VPN8 and YMS-VPN8-CP, VPN client software for Windows, register Windows services with unquoted file paths. A local user with write permissions on the system drive can place a program along the path and have it run with SYSTEM privileges. The attacker needs an existing local foothold, and the vulnerability is not network-exploitable.
Affected
- YMS-VPN8 Ver.1.04.00 and earlier (Windows)
- YMS-VPN8-CP Ver.1.04.00 and earlier (Windows)
Fixed in
- YMS-VPN8 Ver.1.07.00
- YMS-VPN8-CP Ver.1.07.00
Workaround
- Do not share the Windows PC with other users.
- Do not allow untrusted users to log in.
- Do not grant administrative privileges to users who do not require them.
- Do not execute files or programs from unknown or untrusted sources.
- Ensure the service binary paths are quoted and that non-admin users cannot write to directories along the path.
Exploitation
- No exploitation in the wild known.
- Aggregator sites report no public proof of concept. Not verified against CISA KEV.
- CISA SSVC: not automatable, technical impact total.
Our recommendation
- Inventory YMS-VPN8 and YMS-VPN8-CP on Windows endpoints.
- Update to Ver.1.07.00 where installed.
- Until updated, remove local administrator rights from users and check that the service paths are quoted.
- Note that systems running an affected version remain affected until updated, even if the application is not running.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JVN#30675482 (JPCERT/CC) jvn.jp
- Yamaha RT Series Security FAQ (vendor, Japanese) www.rtpro.yamaha.co.jp
- Yamaha YMS-VPN8 readme (vendor) www.rtpro.yamaha.co.jp
- Yamaha VPN Client 8 download page (vendor) network.yamaha.com
- VulDB entry 428382 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:51.
Original description (NVD)
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.