The installer of RATOC RAID Monitoring Manager for Windows permits users to select a custom installation directory. When a non‑default folder is chosen, the installer can leave the folder's access‑control lists insecure, allowing non‑administrative users to modify its contents. By replacing or editing these files, an attacker can execute arbitrary code that runs with SYSTEM privileges, granting full control over the system.

The vulnerability affects RATOC RAID Monitoring Manager for Windows from RATOC Systems, Inc. The CVE advisory does not specify affected versions, so any installation that permits custom folder selection could be impacted.

The CVSS score of 8.5 indicates a high severity vulnerability. EPSS data is not available and the flaw is not listed in CISA's KEV catalog. The likely attack vector is local: a non‑administrative user who can install or modify the application. Exploitation requires manipulating the insecure ACLs of the installation directory; once the attacker gains write access to the directory, they can replace executable files or inject malicious code, thereby executing it with SYSTEM privilege and compromising confidentiality, integrity, and availability.