A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.

A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.

A privilege escalation vulnerability exists in Phoenix Contact Device and Update Management prior to version 2025.3.1 due to misconfigured permissions on nssm.exe in the DAUM-WINDOWS-SERVICE. This misconfiguration allows a low-privileged local user to execute arbitrary code with administrative privileges.