The vulnerability allows an attacker who has compromised the installation host to replace the legitimate Enervista UR Setup DLL with a malicious file. This hijacked DLL can be executed by the installation software, giving the attacker the ability to run arbitrary code with the privileges of the service under which the UR Setup runs. The flaw is a classic DLL hijacking issue (CWE‑35), leading to unauthorized code execution.

The affected product is GE Vernova Enervista UR Setup, version 8.6 and earlier, running on Windows operating systems. Users of those versions are at risk if the installation folder is writable by unauthenticated or low‑privileged local users.

The CVSS score is 4.6, indicating moderate severity, while the EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local compromise of the host machine; an attacker would need to gain sufficient privileges to write to the installation directory. Given the low probability of exploitation and the fact that the flaw requires a pre‑existing local compromise, the overall risk is moderate but should be mitigated promptly through patching or other controls.