CVE-2025-59866

LowCVSS 3.3/10Last modified Sep 29, 2026

Description

The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 17, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-598685.5HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit CVE-2025-59878.1A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this e CVE-2025-598709.8HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , CVE-2025-598729.8HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possib CVE-2025-598735.9An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tok CVE-2025-598748.1HCL Hive Telco Observability is affected by a Required directives missing from the CSP issue is detected in keycloak component of the web a CVE-2025-59885.3A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to e CVE-2025-598868.8Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access t CVE-2025-598878.6Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker CVE-2025-598886.7Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with CVE-2025-598898.6Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the CVE-2025-598907.3Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead int