Vulnerability caused by unquoted file paths of Windows services registered by the…
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-428.
Summary
A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OMRON SOCIAL SOLUTIONS CO., Ltd. | PowerAttendant Standard Edition | up to 2.0.0 | — | No fix listed | CNA |
| OMRON SOCIAL SOLUTIONS CO., Ltd. | PowerAttendant Basic Edition | up to 1.1.0 | — | No fix listed | CNA |
| OMRON SOCIAL SOLUTIONS CO., Ltd. | PowerAct Pro <Slave Agent> | up to 5.20 | — | No fix listed | CNA |
| OMRON SOCIAL SOLUTIONS CO., Ltd. | PowerAct Pro <Master Agent> | up to 5.17 | — | No fix listed | CNA |
| OMRON SOCIAL SOLUTIONS CO., Ltd. | Simple Shutdown Software | up to 2.51 | — | No fix listed | CNA |
- PowerAttendant Standard Edition VendorOMRON SOCIAL SOLUTIONS CO., Ltd. Affected up to 2.0.0 Fixed in — No fix listed CNA
- PowerAttendant Basic Edition VendorOMRON SOCIAL SOLUTIONS CO., Ltd. Affected up to 1.1.0 Fixed in — No fix listed CNA
- PowerAct Pro <Slave Agent> VendorOMRON SOCIAL SOLUTIONS CO., Ltd. Affected up to 5.20 Fixed in — No fix listed CNA
- PowerAct Pro <Master Agent> VendorOMRON SOCIAL SOLUTIONS CO., Ltd. Affected up to 5.17 Fixed in — No fix listed CNA
- Simple Shutdown Software VendorOMRON SOCIAL SOLUTIONS CO., Ltd. Affected up to 2.51 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-9818
- 2026-10-03 Alias added: GHSA-4v26-47w8-q4gm
References
More OMRON SOCIAL SOLUTIONS CO., Ltd. vulnerabilities
- TI-2026-04724 Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application CVSS 3.1HIGH 7.8
Sources
- CVE-2025-9818 · CVE Program
- CVE-2025-9818 · NVD
- FIRST EPSS
- GHSA-4v26-47w8-q4gm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences