CVE-2025-66269

The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables live in

CVSS

No CVSS.

References

Link	Resource
https://www.megatec.com.tw/software-download/

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Los servicios RupsMon y USBMate en UPSilon 2000 se ejecutan con privilegios de SYSTEM y contienen rutas de servicio sin comillas. Esto permite a un atacante local realizar una intercepción de ruta y escalar privilegios si tienen permisos de escritura en los directorios que preceden a aquel donde residen los ejecutables del servicio real.

Information

Published : 2025-11-26 02:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-66269

Mitre link : CVE-2025-66269

CVE.ORG link : CVE-2025-66269

JSON object : View

Products Affected

No product.

CWE

CWE-428

Unquoted Search Path or Element

{"id": "CVE-2025-66269", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66269", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-26T14:20:06.917953Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce", "affectedData": [{"vendor": "MegaTec Taiwan", "product": "UPSilon2000V6.0", "versions": [{"status": "affected", "version": "6.0.5"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-26T02:15:50.130", "references": [{"url": "https://www.megatec.com.tw/software-download/", "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce", "description": [{"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables live in"}, {"lang": "es", "value": "Los servicios RupsMon y USBMate en UPSilon 2000 se ejecutan con privilegios de SYSTEM y contienen rutas de servicio sin comillas. Esto permite a un atacante local realizar una intercepci\u00f3n de ruta y escalar privilegios si tienen permisos de escritura en los directorios que preceden a aquel donde residen los ejecutables del servicio real."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "b7efe717-a805-47cf-8e9a-921fca0ce0ce"}