The flaw in Fuji Electric’s UPS management software stems from incorrect default permissions on its installation directory in versions prior to 3.9.0. An attacker who can write to that folder can deposit a malicious executable. Because the application runs with SYSTEM privileges, the injected binary is executed with that highest level of authority, delivering arbitrary code execution on the host. This pattern matches CWE‑276, improper permission handling, and results in a classic local privilege escalation scenario.

Fuji Electric Co., Ltd.’s Pupsman UPS management software is impacted. Vulnerable releases are any version before 3.9.0. The CVE does not specify the operating system; therefore it is assumed that the software may run on typical Windows platforms supporting SYSTEM privileges, but no concrete OS inference is made beyond this.

The CVSS score of 8.5 classifies the weakness as high severity. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. The attack path requires local write access to the installation directory; it is inferred that if the directory were exposed through a remote service or file‑upload feature, an attacker could potentially exploit the vulnerability remotely, though such a vector is not explicitly confirmed by the description.