EUVD-2026-42165
GHSA-jrgq-cr5h-83px
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local write access to installer folder
-
DeliveryPlant malicious DLL matching search path
-
ExploitVictim runs Pupsman installer
-
ExecutionInstaller loads attacker DLL
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Requires (1) local write access to the exact folder where the Pupsman (pre-3.9.0) installer resides, allowing placement of a crafted DLL with the name the installer resolves, and (2) a user or administrator subsequently executing that installer (CVSS UI:A). Exploitation is limited by these factors: it is not remote (AV:L), the malicious DLL must already sit in the installer's directory before launch, and it only triggers during the install run - it does not affect an already-installed, running system. Privilege gained is SYSTEM because installers typically execute elevated. No authentication to the product is needed (PR:N), but the local file-drop and victim-execution prerequisites substantially narrow realistic attack surface. |
| Impact | The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) scores 8.4 and correctly captures the trade-off: high technical impact (full C/I/A on the vulnerable system, SYSTEM-level) but gated by local access and required user interaction - the victim must execute the installer from a directory the attacker has already written to. There is no EPSS score, no KEV listing, and no known POC provided, so real-world exploitation pressure appears low and opportunistic rather than mass-scale. This is a legitimate local EPE/RCE issue but not an internet-facing, wormable one; prioritize it where the installer is staged in shared, writable, or user-download locations, and lower priority where installers are run only from controlled admin media. No signals conflict - the local vector and interaction requirement are consistent across the description and CVSS 4.0 vector. |
| Exploit ScenarioDerived | An attacker with the ability to write to a shared directory or a user's Downloads folder plants a malicious DLL named to match one the Pupsman installer loads. When an administrator later runs the installer from that same folder, the planted DLL is loaded and executes attacker code with SYSTEM privilege. Because AV is local and UI is required, the attacker relies on the victim initiating the install rather than a remote trigger; no public POC is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Local privilege escalation to arbitrary code execution affects Fuji Electric's Pupsman UPS management software in all versions prior to 3.9.0, where the installer insecurely loads a DLL from its own directory. A local attacker who can drop a malicious DLL into the folder containing the installer can have it executed with SYSTEM privilege the next time the installer is run. No public exploit identified at time of analysis and the flaw is not in CISA KEV; exploitation requires local file placement plus a victim executing the installer (UI:A).
RemediationAI
Upgrade to Pupsman 3.9.0 or later, which the vendor released to address this issue (Vendor-released patch: 3.9.0); consult the vendor page at https://www.fujielectric.co.jp/products/power_supply/ups/product_detail/software_pupsman.html and the JVN advisory https://jvn.jp/en/jp/JVN62347140/ for download details. Until upgraded, only run the installer from a trusted, non-writable location such as freshly-extracted read-only media or a dedicated directory that no unprivileged user can write to, rather than from shared folders or the browser Downloads directory where an attacker could pre-stage a malicious DLL; verify installer integrity (hash/signature) before execution. The trade-off of these controls is operational friction - staging installers to a locked-down path and hash-checking each run adds steps to deployment workflows but directly removes the attacker's DLL-placement opportunity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-427 (Uncontrolled Search Path Element), commonly known as DLL search-order hijacking or DLL pre-loading/side-loading. Windows resolves an unqualified DLL name by searching a defined order of directories, and by default the application's launch directory is searched early. Because the Pupsman installer references a DLL without a fully-qualified path, an attacker-supplied DLL of the same name placed alongside the installer binary is loaded and its DllMain executes in the installer's security context. Installers frequently run elevated, which is why code execution here lands at SYSTEM. The single affected package is identified by CPE cpe:2.3:a:fuji_electric_co.,ltd.:pupsman:*:*:*:*:*:*:*:*, a power-supply/UPS monitoring utility (tagged RCE, Pupsman).
Know when Pupsman gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local DLL-planting with no prior privileges (PR:N) but requiring the victim to run the installer (UI:R); full SYSTEM-level compromise gives C/I/A:H, scope unchanged.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
1DescriptionCVE.org
Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.
Executive ViewAI
Fuji Electric's Pupsman UPS management software contains a local privilege escalation vulnerability (CVSS 8.4) in all versions prior to 3.9.0 that could allow attackers to execute arbitrary code with SYSTEM privileges on affected systems. Organizations managing critical power infrastructure through Pupsman face potential system compromise if attackers obtain local access and can trigger the installer. No patch is currently available, requiring immediate interim protective measures.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict installer execution to authorized administrators only via endpoint policies; (2) Implement file integrity monitoring on Pupsman installation directories to detect malicious DLL placement; (3) Enable comprehensive Windows event logging and audit SYSTEM-level process execution from the Pupsman directory; (4) Apply principle of least privilege to all user and service accounts; (5) Network segmentation-isolate UPS management systems from general corporate network access; (6) Maintain system backups and recovery procedures given the operational criticality of UPS infrastructure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB