CVE-2025-66269
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-26

Last updated on: 2025-11-26

Assigner: Gridware

Description
The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables live in
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-26
Last Modified
2025-11-26
Generated
2026-06-16
AI Q&A
2025-11-26
EPSS Evaluated
2026-06-14
NVD
CVE-2025-66269
EUVD
EUVD-2025-199687
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
upsilon upsilon_2000 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-428 The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in the RupsMon and USBMate services of UPSilon 2000, which run with SYSTEM privileges and have unquoted service paths. This configuration allows a local attacker who has write permissions to certain directories to perform path interception, potentially leading to privilege escalation by executing malicious code instead of the intended service executable.

Impact Analysis

This vulnerability can allow a local attacker to escalate their privileges to SYSTEM level on the affected system. This means the attacker could gain full control over the system, potentially leading to unauthorized access, data manipulation, or disruption of services.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart