CVE-2025-66269
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-11-26
Assigner: Gridware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| upsilon | upsilon_2000 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the RupsMon and USBMate services of UPSilon 2000, which run with SYSTEM privileges and have unquoted service paths. This configuration allows a local attacker who has write permissions to certain directories to perform path interception, potentially leading to privilege escalation by executing malicious code instead of the intended service executable.
How can this vulnerability impact me? :
This vulnerability can allow a local attacker to escalate their privileges to SYSTEM level on the affected system. This means the attacker could gain full control over the system, potentially leading to unauthorized access, data manipulation, or disruption of services.