Local Privilege Escalation via Insecure Update Mechanism in iMonitor EAM
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\SYSTEM privileges. This service includes an insecure update mechanism that automatically loads files placed in the C:\sysupdate\ directory during startup. Because any local user can create and write to this directory, an attacker can place malicious DLLs or executables in it. Upon service restart, the files are moved to the application’s installation path and executed with SYSTEM privileges, leading to privilege escalation.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| iMonitor Software Inc. | iMonitor EAM | 9.63.94 | — | No fix listed | CNA |
- iMonitor EAM VendoriMonitor Software Inc. Affected 9.63.94 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-10541
- 2026-10-03 Alias added: GHSA-mw5x-5ggx-p642
References
Advisory 1
More iMonitor Software Inc. vulnerabilities
- TI-2025-09647 Insecure Default Admin Credentials Enable Full Administrative Access in iMonitor EAM CVSS 3.1CRITICAL 9.8
- TI-2025-09645 Unencrypted and Unauthenticated Communication Allows Data Exposure and Manipulation in iMonitor EAM CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-10541 · CVE Program
- CVE-2025-10541 · NVD
- FIRST EPSS
- GHSA-mw5x-5ggx-p642 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences