CVE-2025-67450

{"id": "CVE-2025-67450", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67450", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-26T14:55:41.664201Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}]}, "affected": [{"source": "CybersecurityCOE@eaton.com", "affectedData": [{"vendor": "Eaton", "product": "UPS Companion software", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-26T07:15:45.850", "references": [{"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1027.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "CybersecurityCOE@eaton.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "CybersecurityCOE@eaton.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Due to insecure library loading in the Eaton UPS Companion software executable,\u00a0an attacker with access to the software package\n\n could perform arbitrary code execution .\u00a0This security issue has been fixed in the latest version of EUC which is available on the Eaton download center."}, {"lang": "es", "value": "Debido a la carga insegura de bibliotecas en el ejecutable del software Eaton UPS Companion, un atacante con acceso al paquete de software podr\u00eda realizar ejecuci\u00f3n de c\u00f3digo arbitrario. Este problema de seguridad ha sido corregido en la \u00faltima versi\u00f3n de EUC, que est\u00e1 disponible en el centro de descargas de Eaton."}], "lastModified": "2026-10-07T13:10:00.713", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eaton:ups_companion:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BC00703-4C6B-4A5B-AC24-01DE7F519FCB", "versionEndExcluding": "3.0"}], "operator": "OR"}]}], "sourceIdentifier": "CybersecurityCOE@eaton.com"}