CVE-2025-66269
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-26

Last updated on: 2025-11-26

Assigner: Gridware

Description
The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables live in

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-11-26
Last Modified
2025-11-26
Generated
2026-07-06
AI Q&A
2025-11-26
EPSS Evaluated
2026-07-05
NVD
CVE-2025-66269
EUVD
EUVD-2025-199687

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
upsilon upsilon_2000 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-428 The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in the RupsMon and USBMate services of UPSilon 2000, which run with SYSTEM privileges and have unquoted service paths. This configuration allows a local attacker who has write permissions to certain directories to perform path interception, potentially leading to privilege escalation by executing malicious code instead of the intended service executable.

Impact Analysis

This vulnerability can allow a local attacker to escalate their privileges to SYSTEM level on the affected system. This means the attacker could gain full control over the system, potentially leading to unauthorized access, data manipulation, or disruption of services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart