PT-2025-39390 · Unknown · Imonitor Eam

Published 2025-09-25 · Updated 2025-09-25 · CVE-2025-10541

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iMonitor EAM version 9.6394

Description The iMonitor EAM software version 9.6394 installs a system service, eamusbsrv64.exe, that operates with NT AUTHORITYSYSTEM privileges. This service contains an insecure update mechanism that automatically loads files located in the C:sysupdate directory during startup. Any local user can create and write to this directory, allowing an attacker to place malicious DLLs or executables within it. When the service restarts, these files are moved to the application’s installation path and executed with SYSTEM privileges, resulting in privilege escalation.

Recommendations Ensure the C:sysupdate directory is properly secured to prevent unauthorized file creation and modification. Restrict local user access to the C:sysupdate directory. Monitor the C:sysupdate directory for unexpected file creation or modification. Consider disabling the automatic update mechanism if it is not essential for functionality.

Exploit

Fix

LPE

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2025-10541

Affected Products

Imonitor Eam

References · 7

• 🔥 https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-imonitorsoft-eam · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10541 · Security Note
• http://seclists.org/fulldisclosure/2025/Sep/72 · Note
• https://twitter.com/CVEnew/status/1971226591322833200 · Twitter Post
• https://t.me/cveNotify/136405 · Telegram Post
• https://t.me/CVEtracker/33322 · Telegram Post
• https://r.sec-consult.com/imonitor · Note