ePO, ESM and DXL
CVE-2025-3771: Path or symbolic link manipulation in System Information Reporter
A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, which can potentially cause a system crash.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| System Information Reporter (Windows) 1.0 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, which can potentially cause a system crash. This was achieved by adding a malicious entry to the registry under the Trellix SIR registry folder or via policy or with a junction symbolic link to files that the user would not normally have permission to acces
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.