Eaton UPS Companion CVE-2025-59887

Exploitation requires that the attacker can place a malicious library file within or alongside the Eaton UPS Companion (EUC) installer software package (the input states 'an attacker with the access to the software package'), AND that a user subsequently executes that installer (UI:R). It is a local-only vector (AV:L) - there is no remote or network exploitation path. Key limiting factors: the attacker must already have file-write access to the installer/package location (e.g., a shared staging share, a downloads folder, or a software-distribution point), the victim must run the tampered installer, and only unpatched EUC versions are affected. These prerequisites substantially constrain real-world exploitation despite the high base score.

This is a CWE-427 (uncontrolled library/DLL search-path) flaw in the Eaton UPS Companion (EUC) installer, scored CVSS 8.6 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The high base score is driven primarily by the scope change (S:C) and triple-high impact (C:H/I:H/A:H) typical of code execution during a privileged install, NOT by remote reachability - the attack vector is explicitly LOCAL (AV:L) and requires user interaction (UI:R), meaning an attacker cannot exploit this remotely or without a victim running the tampered installer. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world probability signals are simply absent rather than low. Net assessment: the raw score overstates urgency for most environments - this is a meaningful but conditional local privilege-escalation/code-execution issue that requires the attacker to already place a malicious library alongside the software package and socially engineer or wait for a user to run the installer. It is a patch-when-convenient issue for typical fleets, elevated only where UPS Companion installers are staged on shared or writable locations.

An attacker with write access to the directory containing the Eaton UPS Companion installer package plants a malicious library (DLL) that the installer loads without proper validation. When an administrator or user later runs the installer, the attacker's code executes in the installer's context, which can be elevated - yielding arbitrary code execution. No public exploit code was identified in the provided data, and the local vector plus required user interaction limit this to attackers who can already stage files on the target.