Vulnerability · Published Jul 27, 2025 · Assigned by certcc
CVE-2025-6241CVE-2025-6241
Medium 4.4
In plain English
A medium-severity security flaw in SysTrack from Lakeside Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default installation. If a user-writable directory is present in the SYSTEM PATH environment variable, the user can write a malicious DLL to that directory with arbitrary code. This malicious DLL is executed in the context of NT AUTHORITY\SYSTEM upon service start or restart, due to the Windows default dynamic-link library search order, resulting in local elevation of privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lakeside Software | SysTrack | 10.05.0027 – before 10.10.0.42 |