PT-2025-44303 · Evope+1 · Evope Collector+1

Published 2025-10-29 · Updated 2025-10-29 · CVE-2025-61161

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Evope Collector version 1.1.6.9.0

Description A DLL hijacking issue exists in Evope Collector. The software loads the wtsapi32.dll library from an uncontrolled search path, specifically C:ProgramDataEvope. This allows a local, unprivileged attacker to potentially execute arbitrary code or gain SYSTEM-level privileges by placing a malicious DLL in that directory. The Evope.Service.exe component, running with SYSTEM privileges, automatically loads the DLL during startup or reboot.

Recommendations Ensure the wtsapi32.dll library is located in a secure, controlled directory and is not accessible for modification by unprivileged users.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-61161

Affected Products

Evope Collector

Wtsapi32.Dll

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-61161 · Security Note
• https://t.me/CVEtracker/36052 · Telegram Post
• https://xavilok.es/dll-hijacking-in-evopeservice--system-to-gui-shell · Note
• https://twitter.com/CVEnew/status/1983545890959724549 · Twitter Post
• https://evope.tech · Note