VulnerabilityDeferred

CVE-2025-10549

EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory.

MEDIUM 5.1EPSS 0.16%

Does this matter?

Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.

Description

EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\SYSTEM.

CVSS 3.1: 5.1 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
EPSS: 0.16% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-427
Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

References

https://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95
https://r.sec-consult.com/controlio
http://seclists.org/fulldisclosure/2026/Apr/19

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.