CVE-2026-5397

It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that is then executed with administrator privileges. If a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL may be executed by exploiting the product’s behavior of loading missing DLLs from the same directory as the executable during service startup.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.1 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf
https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf

Configurations

No configuration.

History

15 Apr 2026, 05:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-15 05:16

Updated : 2026-06-17 10:58

NVD link : CVE-2026-5397

Mitre link : CVE-2026-5397

CVE.ORG link : CVE-2026-5397

JSON object : View

Products Affected

No product.

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-5397", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5397", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T13:46:38.260570Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}]}, "affected": [{"source": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "affectedData": [{"vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.", "product": "PowerAttendant Standard Edition", "versions": [{"status": "affected", "version": "2.1.2 or lower", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-04-15T05:16:45.740", "references": [{"url": "https://www.omron.com/global/en/inquiry/data/OMSR-2026-001_en.pdf", "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1"}, {"url": "https://www.omron.com/jp/ja/inquiry/data/OMSR-2026-001_ja.pdf", "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "bba440f9-ef23-4224-aa62-7ac0935d18d1", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the installation directory allow a malicious actor to place a DLL that\u00a0is then executed with administrator privileges.\n\nIf a malicious DLL is placed in the installation directory of this product, there is a possibility that the malicious DLL\u00a0may be executed by exploiting the product\u2019s behavior of loading missing DLLs from the same directory as the executable during service startup."}], "lastModified": "2026-06-17T10:58:57.633", "sourceIdentifier": "bba440f9-ef23-4224-aa62-7ac0935d18d1"}