What’s Vulnerable › Vulnerabilities
CVE-2025-66265: Insecure permissions in configuration directory (C:\\usr)
- Severity: medium (CVSS 6.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-26 · updated 2026-10-18
- Weakness: CWE-269
Description
CMService.exe creates the C:\\usr directory and subdirectories with insecure permissions, granting write access to all authenticated users. This allows attackers to replace configuration files (such as snmp.conf) or hijack DLLs to escalate privileges.
Affected products
- MegaTec Taiwan ClientMate: 6.2.2
References
Get alerted when CVE-2025-66265 or the next vulnerability affects your stack