CVE-2025-66265

CMService.exe creates the C:\usr directory and subdirectories with insecure permissions, granting write access to all authenticated users. This allows attackers to replace configuration files such as snmp.conf or hijack DLLs to escalate privileges...

CVE-2025-66264

CVE-2025-66264 describes an unquoted service path in the CMService.exe service that runs with SYSTEM privileges, enabling a local attacker who has filesystem write access to place a malicious executable in the path and escalate privileges. The issue affects the UPSilon2000V6.0-related service as ...