CVE-2025-59887: Eaton UPS Companion RCE Vulnerability

CVE-2025-59887 Overview

CVE-2025-59887 is a high-severity vulnerability in the Eaton UPS Companion (EUC) software installer. The flaw stems from improper authentication of library files loaded during installation [CWE-427]. An attacker with access to the software package can replace or plant malicious library files to achieve arbitrary code execution. Eaton has resolved this issue in the latest version of EUC available through the Eaton download center.

Critical Impact
Attackers who tamper with the installer package can execute arbitrary code in the context of the user running the installation, leading to full host compromise.

Affected Products

Eaton UPS Companion (EUC) software installer — versions prior to the fixed release
Windows endpoints running the vulnerable installer
Systems where the EUC installation package is staged on shared or writable locations

Discovery Timeline

2025-12-26 - CVE-2025-59887 published to the National Vulnerability Database
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-59887

Vulnerability Analysis

The vulnerability is an uncontrolled search path / improper library authentication issue [CWE-427] in the EUC installer. The installer loads supporting library files without validating their authenticity or integrity. An attacker who can write to the directory containing the installer, or who controls the distribution channel, can introduce a malicious dynamic library. When a user runs the installer, the planted library loads and executes attacker-controlled code.

The attack requires local access to the software package and user interaction to launch the installer. Successful exploitation yields high impact on confidentiality, integrity, and availability, and the scope changes because code executes outside the installer's intended trust boundary.

Root Cause

The installer fails to verify the digital signature or expected hash of library files it loads at runtime. Without authentication of these dependencies, the loader resolves and executes whichever library is present in the search path. This pattern is commonly referred to as DLL hijacking or DLL planting on Windows systems.

Attack Vector

The attack vector is local. An attacker stages a malicious library alongside the legitimate EUC installer, for example in a shared download folder, removable media, or a compromised distribution mirror. When a user executes the installer, the planted library is loaded in place of the legitimate dependency. Code then runs with the privileges of the user invoking the installer. See the Eaton Security Bulletin ETN-VA-2025-1026 for vendor details.

Detection Methods for CVE-2025-59887

Indicators of Compromise

Unsigned or untrusted DLL files placed in the same directory as the EUC installer executable
Unexpected child processes spawned by the EUC installer during or shortly after execution
Library load events referencing DLLs from user-writable directories such as Downloads or removable media
New persistence artifacts (scheduled tasks, registry Run keys, services) created during EUC installation

Detection Strategies

Monitor Windows Sysmon Event ID 7 (ImageLoad) for the EUC installer process loading DLLs from non-standard paths
Alert on installer executables loading libraries that lack a valid Eaton or Microsoft Authenticode signature
Inspect endpoint download directories for the presence of DLLs co-located with vendor installers
Compare hashes of staged installer packages against vendor-published values before execution

Monitoring Recommendations

Enable PowerShell and process creation logging on systems where administrative installations occur
Forward installer execution telemetry to a centralized SIEM for correlation with library load activity
Track first-seen DLLs in installer staging paths across the fleet to surface planting attempts

How to Mitigate CVE-2025-59887

Immediate Actions Required

Download the latest EUC release directly from the official Eaton download center and verify file integrity before execution
Remove any copies of the vulnerable EUC installer from shared drives, file servers, and user download directories
Restrict write permissions on directories used to stage installation packages so non-administrative users cannot drop libraries
Re-run installations only from clean, controlled directories on trusted endpoints

Patch Information

Eaton has released a fixed version of UPS Companion through the Eaton download center. Administrators should obtain the latest EUC build and replace any previously deployed vulnerable installers. Refer to Eaton Security Bulletin ETN-VA-2025-1026 for the authoritative patch reference.

Workarounds

Execute the EUC installer only from an empty, access-controlled directory to prevent side-loading of attacker DLLs
Enforce application control policies (Windows Defender Application Control, AppLocker) to block unsigned DLL loads from user-writable paths
Require code-signing verification on all installer dependencies before allowing execution in change-controlled environments

bash

# Example AppLocker DLL rule logic (conceptual)
# Deny DLL loads from user-writable paths during installer execution
# Allow only DLLs signed by the trusted vendor publisher