CVE-2025-10541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10541", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2025-09-16T07:44:45.725Z", "datePublished": "2025-09-25T14:31:32.644Z", "dateUpdated": "2025-11-03T18:08:40.379Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "iMonitor EAM", "vendor": "iMonitor Software Inc.", "versions": [{"status": "affected", "version": "9.63.94"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Marius Renner, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Tobias Niemann, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Thorger Jansen, SEC Consult Vulnerability Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p></p><p>iMonitor EAM 9.6394 installs a system service (<code>eamusbsrv64.exe</code>) that runs with <code>NT AUTHORITY\\SYSTEM</code> privileges. This service includes an insecure update mechanism that automatically loads files placed in the <code>C:\\sysupdate\\</code> directory during startup. Because any local user can create and write to this directory, an attacker can place malicious DLLs or executables in it. Upon service restart, the files are moved to the application\u2019s installation path and executed with SYSTEM privileges, leading to privilege escalation.</p><p></p>"}], "value": "iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\\SYSTEM privileges. This service includes an insecure update mechanism that automatically loads files placed in the C:\\sysupdate\\ directory during startup. Because any local user can create and write to this directory, an attacker can place malicious DLLs or executables in it. Upon service restart, the files are moved to the application\u2019s installation path and executed with SYSTEM privileges, leading to privilege escalation."}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2025-09-25T14:31:32.644Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://r.sec-consult.com/imonitor"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vendor was unresponsive and did not answer to our communication attempts. Therefore, a patch is not available for these security issues. End users of this product should contact the vendor and demand a patch.</p>"}], "value": "The vendor was unresponsive and did not answer to our communication attempts. Therefore, a patch is not available for these security issues. End users of this product should contact the vendor and demand a patch."}], "source": {"discovery": "EXTERNAL"}, "title": "Local Privilege Escalation via Insecure Update Mechanism in iMonitor EAM", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"references": [{"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-imonitorsoft-eam/", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-25T18:26:47.792796Z", "id": "CVE-2025-10541", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-25T18:27:39.262Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Sep/72"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T18:08:40.379Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Sep/72"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T18:08:40.379Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-10541", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-25T18:26:47.792796Z"}}}], "references": [{"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-imonitorsoft-eam/", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-25T18:27:32.400Z"}}], "cna": {"title": "Local Privilege Escalation via Insecure Update Mechanism in iMonitor EAM", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Marius Renner, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Daniel Hirschberger, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Tobias Niemann, SEC Consult Vulnerability Lab"}, {"lang": "en", "type": "finder", "value": "Thorger Jansen, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "affected": [{"vendor": "iMonitor Software Inc.", "product": "iMonitor EAM", "versions": [{"status": "affected", "version": "9.63.94"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "The vendor was unresponsive and did not answer to our communication attempts. Therefore, a patch is not available for these security issues. End users of this product should contact the vendor and demand a patch.", "supportingMedia": [{"type": "text/html", "value": "<p>The vendor was unresponsive and did not answer to our communication attempts. Therefore, a patch is not available for these security issues. End users of this product should contact the vendor and demand a patch.</p>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/imonitor", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\\SYSTEM privileges. This service includes an insecure update mechanism that automatically loads files placed in the C:\\sysupdate\\ directory during startup. Because any local user can create and write to this directory, an attacker can place malicious DLLs or executables in it. Upon service restart, the files are moved to the application\u2019s installation path and executed with SYSTEM privileges, leading to privilege escalation.", "supportingMedia": [{"type": "text/html", "value": "<p></p><p>iMonitor EAM 9.6394 installs a system service (<code>eamusbsrv64.exe</code>) that runs with <code>NT AUTHORITY\\SYSTEM</code> privileges. This service includes an insecure update mechanism that automatically loads files placed in the <code>C:\\sysupdate\\</code> directory during startup. Because any local user can create and write to this directory, an attacker can place malicious DLLs or executables in it. Upon service restart, the files are moved to the application\u2019s installation path and executed with SYSTEM privileges, leading to privilege escalation.</p><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2025-09-25T14:31:32.644Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10541", "state": "PUBLISHED", "dateUpdated": "2025-11-03T18:08:40.379Z", "dateReserved": "2025-09-16T07:44:45.725Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2025-09-25T14:31:32.644Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "iMonitor EAM", "vendor": "iMonitor Software Inc.", "versions": [{"status": "affected", "version": "9.63.94"}]}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\\SYSTEM privileges. This service includes an insecure update mechanism that automatically loads files placed in the C:\\sysupdate\\ directory during startup. Because any local user can create and write to this directory, an attacker can place malicious DLLs or executables in it. Upon service restart, the files are moved to the application\u2019s installation path and executed with SYSTEM privileges, leading to privilege escalation."}, {"lang": "es", "value": "iMonitor EAM 9.6394 instala un servicio del sistema (eamusbsrv64.exe) que se ejecuta con privilegios de NT AUTHORITY\\SYSTEM. Este servicio incluye un mecanismo de actualizaci\u00f3n inseguro que carga autom\u00e1ticamente archivos ubicados en el directorio C:\\sysupdate\\ durante el inicio. Debido a que cualquier usuario local puede crear y escribir en este directorio, un atacante puede colocar DLLs o ejecutables maliciosos en \u00e9l. Al reiniciar el servicio, los archivos se mueven a la ruta de instalaci\u00f3n de la aplicaci\u00f3n y se ejecutan con privilegios de SYSTEM, lo que lleva a una escalada de privilegios."}], "id": "CVE-2025-10541", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10541", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-25T18:26:47.792796Z", "version": "2.0.3"}}]}, "published": "2025-09-25T15:16:09.270", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/imonitor"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Sep/72"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-imonitorsoft-eam/"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}

{"created": "2025-09-29T09:31:34.900560+00:00", "updated": "2025-09-29T09:31:34.900621+00:00", "vendors": ["imonitor", "imonitor$PRODUCT$imonitor_eam"]}