CVE-2025-6241: Lakeside Software Systrack

Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days.

LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default installation. If a user-writable directory is present in the SYSTEM PATH environment variable, the user can write a malicious DLL to that directory with arbitrary code. This malicious DLL is executed in the context of NT AUTHORITY\SYSTEM upon service start or restart, due to the Windows default dynamic-link library search order, resulting in local elevation of privileges.

Affected products

• Lakeside Software Systrack: from 10.05.0027, before 10.10.0.42 (fixed in 10.10.0.42)

Published 2025-07-27. Last modified 2026-06-17.