VULNERABILITY INTELLIGENCE
CVE-2025-66265
CVSS score6.9 MEDIUM
EPSS probability0.12%
CISA KEVNot currently listed
Published2025-11-26
Last modified2026-10-18
CVSS vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L
Description
CMService.exe creates the C:\\usr directory and subdirectories with insecure permissions, granting write access to all authenticated users. This allows attackers to replace configuration files (such as snmp.conf) or hijack DLLs to escalate privileges.
Weakness classification
- CWE-269: Improper Privilege Management