PT-2025-44303 · Evope+1 · Evope Collector+1

CVE-2025-61161 · Publicado 2025-10-29 · Atualizado 2025-10-29

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Evope Collector version 1.1.6.9.0

Description A DLL hijacking issue exists in Evope Collector. The software loads the wtsapi32.dll library from an uncontrolled search path, specifically C:ProgramDataEvope. This allows a local, unprivileged attacker to potentially execute arbitrary code or gain SYSTEM-level privileges by placing a malicious DLL in that directory. The Evope.Service.exe component, running with SYSTEM privileges, automatically loads the DLL during startup or reboot.

Recommendations Ensure the wtsapi32.dll library is located in a secure, controlled directory and is not accessible for modification by unprivileged users.

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2025-61161

Produtos afetados

Evope Collector

Wtsapi32.Dll

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-61161 · Nota de Segurança
• https://t.me/CVEtracker/36052 · Publicação no Telegram
• https://xavilok.es/dll-hijacking-in-evopeservice--system-to-gui-shell · Nota
• https://twitter.com/CVEnew/status/1983545890959724549 · Publicação no Twitter
• https://evope.tech · Nota