CVE-2025-66269

HighCVSS 7.1

Published: 26/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. A local attacker with write permissions to directories preceding the real service executable locations can perform path interception and escalate privileges.

Risk Assessment

A low-privileged local user could gain SYSTEM privileges and take control of the system, provided they can write to the relevant directories.

Recommendation

Fix the service path configuration by quoting the paths, and restrict write access to directories containing the service executables.

Other vulnerabilities in UPSilon 2000

CVE-2025-66266Critical
The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker can replace the executable with a malicious binary to execute code with SYSTEM privileges or simply change the config path of the service to a command; starting and stopping the service to immediately achieve code execution and privilege escalation.

Original NVD description (English source)

The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables live in

Vulnerability data from NVD (NIST) · CISA KEV · EPSS