The flaw in Pupsman is caused by incorrect default permissions set on the installation directory in releases prior to version 3.9.0. An attacker who can write a file into that folder can place a malicious executable that will be launched with the application’s SYSTEM privileges, giving the attacker arbitrary code execution on the host. This is a classic example of CWE-276, where improper permission handling leads to privilege escalation.

Fuji Electric Co., Ltd.’s UPS management software Pupsman is affected. Versions prior to 3.9.0 are vulnerable. The operating systems on which these versions run are not specified in the CVE, so any assumption about affected OS is inferred.

The vulnerability has a CVSS score of 8.5, indicating high severity. The EPSS score is less than 1%, showing a low probability of exploitation in the wild, and it is not cataloged in CISA’s KEV. An attacker who can write a file to the installation directory can place a malicious executable that will run with SYSTEM privileges, enabling arbitrary code execution. This requires local write access to the directory; it is inferred that if the directory were exposed and writable over a network or through a file upload feature, an attacker could also exploit the flaw remotely, but such an attack vector is not explicitly stated in the description.