Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2025-66266

Insecure SYSTEM Service Permissions in UPSilon2000V6.0 (RupsMon.exe) leading to trivial Local Privilege Escalation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Gridware

Description

The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker can replace the executable with a malicious binary to execute code with SYSTEM privileges or simply change the config path of the service to a command; starting and stopping the service to immediately achieve code execution and privilege escalation

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MegaTec Taiwan UPSilon2000V6.0

Default version status: unaffected

  • 6.0.5affected

References