CVE-2025-59888

{"id": "CVE-2025-59888", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59888", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-26T15:37:33.011545Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 0.8}]}, "affected": [{"source": "CybersecurityCOE@eaton.com", "affectedData": [{"vendor": "Eaton", "product": "UPS Companion software", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-26T07:15:45.693", "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1026.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "CybersecurityCOE@eaton.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "description": [{"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the \n\nfile system. This security issue has been fixed in the latest version of EUC which is available on the Eaton download center."}, {"lang": "es", "value": "Comillas incorrectas en las rutas de b\u00fasqueda en el instalador del software Eaton UPS Companion podr\u00edan llevar a la ejecuci\u00f3n de c\u00f3digo arbitrario de un atacante con acceso al sistema de archivos. Este problema de seguridad ha sido corregido en la \u00faltima versi\u00f3n de EUC, la cual est\u00e1 disponible en el centro de descargas de Eaton."}], "lastModified": "2026-10-07T13:10:00.713", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eaton:ups_companion:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BC00703-4C6B-4A5B-AC24-01DE7F519FCB", "versionEndExcluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "CybersecurityCOE@eaton.com"}