CVE-2025-66266
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-11-26
Assigner: Gridware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| upsilon | upsilon_2000 | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the RupsMon.exe service executable in UPSilon 2000 having insecure permissions that allow the 'Everyone' group full control. This means a local attacker can replace the executable with a malicious binary or change the service's configuration path to a command. By starting and stopping the service, the attacker can execute code with SYSTEM privileges, leading to privilege escalation.
How can this vulnerability impact me? :
The vulnerability can allow a local attacker to execute arbitrary code with SYSTEM-level privileges on the affected system. This can lead to full control over the system, unauthorized access, and potential compromise of sensitive data or system integrity.