Eaton UPS Companion CVE-2025-67450

Exploitation requires the attacker to already have local access to the host running Eaton UPS Companion and the ability to write a malicious library into a directory that the trusted UPS Companion executable searches during library loading (CWE-427). Limiting factors: this is local-only (AV:L), requires existing low-privilege access (PR:L), and is high-complexity (AC:H) - meaning success depends on specific, non-guaranteed conditions such as a writable/attacker-controlled search path, correct library name, and the application actually loading that library. There is no network vector and no evidence of a default-configuration remote exploit.

This is a local, moderate-complexity code-execution flaw rather than a remotely-wormable emergency. The supplied CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local, low-privilege access to the host running Eaton UPS Companion and must satisfy specific conditions (AC:H) - consistent with CWE-427 insecure library loading (DLL/shared-object hijacking), where a malicious library must be planted in a path the trusted executable searches. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or opportunistic exploitation; the realistic use case is a local privilege-escalation or persistence step by an attacker who has already gained a foothold, not mass remote compromise. The base score of 7.8 (HIGH) is driven by full C/I/A impact and the vendor's scope-change (S:C) assertion, but the local vector plus high complexity meaningfully lowers real-world urgency compared to a network-exploitable 7.8. Note a divergence worth verifying: the description phrase 'an attacker with access to the software package' suggests write access to the install directory or the library search path, which argues for PR:L/PR:H and high complexity, not low-friction exploitation. Also note the vendor-assigned S:C (scope change) is plausible only if the hijacked library executes in a higher-privilege context than the attacker's - this should be confirmed with the Eaton bulletin.

An attacker who already has a low-privileged local account on a Windows host where Eaton UPS Companion is installed places a malicious library in a directory the UPS Companion executable searches before the legitimate one. When the application (or its service) next loads that library, the attacker's code runs in the application's context, yielding arbitrary code execution and potential privilege escalation. No public exploit code was identified in the provided data.