CVE-2025-9818 MEDIUM

CVE-2025-9818: Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application

Vendor Omron Social Solutions Co., Ltd.
Product PowerAttendant Standard Edition
Weakness CWE-428
Published September 17, 2025
Last update September 17, 2025
View on NVD All CVEs

CVSS base score

6.7/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces.

Key dates

02Disclosure timeline

September 17, 2025 CVE published
September 17, 2025 Record updated