CVE-2025-9818CWE-428

CVE-2025-9818

Medium · published September 17, 2025

CVSS v3.1
6.7
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00149 · 3.7th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2025-09-17T08:16Z
References (2)
https://www.omron.com/global/en/inquiry/vulnerability_information/OMSR-2025-005_en.pdf · bba440f9-ef23-4224-aa62-7ac0935d18d1https://www.omron.com/jp/ja/inquiry/vulnerability_information/OMSR-2025-005_ja.pdf · bba440f9-ef23-4224-aa62-7ac0935d18d1
EPSS history
Timeline
  • 17 SEP 03:02Z
    Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application
    cvelistv5