jvndb - jvndb-2025-014105

jvndb-2025-014105

Vulnerability from jvndb

Published

2025-09-19 16:21

Modified

2025-09-19 16:21

Summary

OMRON SOCIAL SOLUTIONS Uninterruptible Power Supply (UPS) management application registers a Windows service with an unquoted file path

Details

Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd. registers a Windows service with an unquoted file path (CWE-428, CVE-2025-9818). OMRON SOCIAL SOLUTIONS Co., Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.

References

▼	Type	URL
	JVN	https://jvn.jp/en/vu/JVNVU93403671/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-9818
	Unquoted Search Path or Element(CWE-428)	https://cwe.mitre.org/data/definitions/428.html

Impacted products

▼	Vendor	Product
	OMRON SOCIAL SOLUTIONS Co.,Ltd.	PowerAct Pro
	OMRON SOCIAL SOLUTIONS Co.,Ltd.	PowerAttendant Basic Edition
	OMRON SOCIAL SOLUTIONS Co.,Ltd.	PowerAttendant Standard Edition
	OMRON SOCIAL SOLUTIONS Co.,Ltd.	Simple Shutdown Software

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-014105.html",
  "dc:date": "2025-09-19T16:21+09:00",
  "dcterms:issued": "2025-09-19T16:21+09:00",
  "dcterms:modified": "2025-09-19T16:21+09:00",
  "description": "Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd. registers a Windows service with an unquoted file path (CWE-428, CVE-2025-9818). \r\n\r\nOMRON SOCIAL SOLUTIONS Co., Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-014105.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:omron_socilal_solutions:poweract_pro",
      "@product": "PowerAct Pro",
      "@vendor": "OMRON SOCIAL SOLUTIONS Co.,Ltd.\t",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:omron_socilal_solutions:powerattendant_basic_edition",
      "@product": "PowerAttendant Basic Edition",
      "@vendor": "OMRON SOCIAL SOLUTIONS Co.,Ltd.\t",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:omron_socilal_solutions:powerattendant_standard_edition",
      "@product": "PowerAttendant Standard Edition",
      "@vendor": "OMRON SOCIAL SOLUTIONS Co.,Ltd.\t",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:omron_socilal_solutions:simple_shutdown_software",
      "@product": "Simple Shutdown Software",
      "@vendor": "OMRON SOCIAL SOLUTIONS Co.,Ltd.\t",
      "@version": "2.2"
    }
  ],
  "sec:identifier": "JVNDB-2025-014105",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU93403671/index.html",
      "@id": "JVNVU#93403671",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-9818",
      "@id": "CVE-2025-9818",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/428.html",
      "@id": "CWE-428",
      "@title": "Unquoted Search Path or Element(CWE-428)"
    }
  ],
  "title": "OMRON SOCIAL SOLUTIONS Uninterruptible Power Supply (UPS) management application registers a Windows service with an unquoted file path"
}

CVE-2025-9818 (GCVE-0-2025-9818)

Vulnerability from cvelistv5

Published

2025-09-17 03:02

Modified

2025-09-17 13:40

Severity ?

6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-428 - Unquoted Search Path or Element

Summary

A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces.

References

▼	URL	Tags
	https://www.omron.com/jp/ja/inquiry/vulnerability_information/OMSR-2025-005_ja.pdf
	https://www.omron.com/global/en/inquiry/vulnerability_information/OMSR-2025-005_en.pdf

Impacted products

Vendor

Product

Version

▼

OMRON SOCIAL SOLUTIONS CO., Ltd.

PowerAttendant Standard Edition

Version: 0 ≤ 2.0.0

OMRON SOCIAL SOLUTIONS CO., Ltd.	PowerAttendant Basic Edition	Version: 0 ≤ 1.1.0
OMRON SOCIAL SOLUTIONS CO., Ltd.	PowerAct Pro <Slave Agent>	Version: 0 <
OMRON SOCIAL SOLUTIONS CO., Ltd.	PowerAct Pro <Master Agent>	Version: 0 <
OMRON SOCIAL SOLUTIONS CO., Ltd.	Simple Shutdown Software	Version: 0 <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-17T13:38:49.600285Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-17T13:40:05.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "PowerAttendant Standard Edition",
          "vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "PowerAttendant Basic Edition",
          "vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "1.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "PowerAct Pro \u003cSlave Agent\u003e",
          "vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "5.20",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "PowerAct Pro \u003cMaster Agent\u003e",
          "vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "5.17",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Simple Shutdown Software",
          "vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "2.51",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces."
            }
          ],
          "value": "A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "No direct mapping"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-428",
              "description": "CWE-428 Unquoted Search Path or Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T03:02:20.527Z",
        "orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
        "shortName": "OMRON"
      },
      "references": [
        {
          "url": "https://www.omron.com/jp/ja/inquiry/vulnerability_information/OMSR-2025-005_ja.pdf"
        },
        {
          "url": "https://www.omron.com/global/en/inquiry/vulnerability_information/OMSR-2025-005_en.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
    "assignerShortName": "OMRON",
    "cveId": "CVE-2025-9818",
    "datePublished": "2025-09-17T03:02:20.527Z",
    "dateReserved": "2025-09-02T07:03:10.550Z",
    "dateUpdated": "2025-09-17T13:40:05.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted