Privilege Escalation Vulnerability in iMonitor EAM by iMonitor Technologies

CVE-2025-10541

What is CVE-2025-10541?

The iMonitor EAM product incorporates a system service that operates with NT AUTHORITY\SYSTEM privileges, creating significant security risks. The service supports an insecure update process that automatically executes files located in the C:\sysupdate\ directory at startup. This directory can be manipulated by any local user, allowing an attacker to place malicious DLLs or executable files there. Upon restarting the service, these files get executed with elevated privileges, potentially leading to unauthorized access and control over the system.

References