Back to Database
Status published
Medium
CVE-2025-66265
Insecure permissions in configuration directory (C:\\usr)
Vulnerability Description
CMService.exe creates the C:\\usr directory and subdirectories with insecure permissions, granting write access to all authenticated users. This allows attackers to replace configuration files (such as snmp.conf) or hijack DLLs to escalate privileges.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66265
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Abdul Mhanni
More from MegaTec Taiwan
View All →CVE-2025-66269
Unquoted Service Path in UPSilon2000V6.0(RupsMon and USBMate) running as SYSTEM
High
7.1
CVE-2025-66266
Insecure SYSTEM Service Permissions in UPSilon2000V6.0 (RupsMon.exe) leading to trivial Local Privilege Escalation
Critical
9.3
CVE-2025-66264
Unquoted Service path in UPSilon2000V6.0 SYSTEM privilege service
High
7.2
Affected Vendor
MegaTec Taiwan
View all reports →Affected Software
ClientMate
Vulnerable Versions:
6.2.2
Timeline
Official Publish:
November 26th, 2025
Last Modified:
November 26th, 2025
Added to House:
July 22nd, 2026