This vulnerability (CWE-427) in the UPS management application PowerAttendant Standard Edition involves an uncontrolled search path element. Specifically, the product loads DLLs from its installation directory without sufficient permission controls, allowing an attacker with local access to place a malicious DLL. Upon service startup, the malicious DLL may be executed with administrator privileges, leading to potential full system compromise. The vulnerability affects versions 2.1.2 and earlier. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with attack vector local, high attack complexity, low privileges required, no user interaction, and scope changed.

Successful exploitation can lead to execution of arbitrary code with administrator privileges on the affected system. This can result in complete compromise of the system's confidentiality, integrity, and availability. The vulnerability requires local access and the ability to place files in the installation directory, which has improper permissions.

No official patch or remediation level has been published by the vendor as of now. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write permissions to the installation directory to trusted administrators only to prevent unauthorized DLL placement. Monitor for any updates from OMRON SOCIAL SOLUTIONS CO., Ltd. regarding patches or official mitigations.