CVE-2025-66269

HighCVSS 7.1/10Last modified Oct 18, 2026

Description

The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories proceeding that of which the real service executables live in

Metrics

CVSS 4.0 7.1/10CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published
Nov 26, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-66278.8A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. This vulnerability affects unknown code ofCVE-2025-662704.7The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on deskCVE-2025-662718.4Clone for Windows provided by ELECOM CO.,LTD. registers a Windows service with an unquoted file path. A user with the write permission on thCVE-2025-662726.5A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit tCVE-2025-662737.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administCVE-2025-662744.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-662756.5A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit tCVE-2025-662769.8QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and laterCVE-2025-662779.8A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit theCVE-2025-662786.5A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2025-662797.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administCVE-2025-662807.2An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gai
CVE-2025-66269: High severity, CVSS 7.1 | Vulnix