CVE-2025-10549: EfficientLab Controlio DLL Hijacking RCE

CVE-2025-10549 Overview

CVE-2025-10549 is a DLL hijacking vulnerability in EfficientLab Controlio versions prior to v1.3.95. The flaw stems from weak folder permissions on the installation directory, which allow a local user to drop a malicious dynamic-link library (DLL) into a path searched by the Controlio service. Because the service runs as NT AUTHORITY\SYSTEM, the planted DLL executes with the highest privileges available on the host. The issue is tracked under CWE-427: Uncontrolled Search Path Element.

Critical Impact
A local attacker with limited privileges can escalate to SYSTEM by planting a crafted DLL in the Controlio installation folder, gaining full control of the affected Windows host.

Affected Products

EfficientLab Controlio versions prior to v1.3.95
Controlio Windows client running with SYSTEM-level service privileges
Windows hosts where the Controlio installation directory has weak access control entries (ACEs)

Discovery Timeline

2026-04-23 - CVE-2025-10549 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10549

Vulnerability Analysis

The Controlio client installs into a directory that grants write access to non-administrative users. The product also runs a persistent background service under the NT AUTHORITY\SYSTEM account. When that service loads supporting DLLs from its installation folder, Windows resolves the library using the standard search order. An attacker who can write to the directory can stage a malicious DLL with a name the service expects to load.

When the service starts or reloads a library, it maps the attacker-controlled DLL into a SYSTEM process. The injected code inherits full kernel-level access rights, enabling credential theft, persistence, and tampering with security tooling. The attack requires only local access and no user interaction.

The vulnerability is local in nature, requires high privileges to stage in some configurations, and produces high integrity impact with low confidentiality impact, reflecting code execution as SYSTEM without direct data exfiltration as the primary vector.

Root Cause

The installation routine sets permissive access control lists (ACLs) on the program folder. Standard users inherit write access to a directory whose contents execute in a privileged security context. Windows binary planting attacks succeed whenever a privileged process loads libraries from a writable location, and Controlio meets both conditions.

Attack Vector

An authenticated local attacker identifies a DLL the Controlio service loads at startup or runtime. The attacker writes a malicious DLL of the same name into the installation directory, then triggers a service restart or waits for the next library load. The Windows loader maps the planted DLL into the SYSTEM-owned process, executing the attacker's DllMain payload with the service's privileges.

No verified exploit code is publicly listed for this issue. Technical details are documented by the reporting researchers at the SEC Consult advisory and the Full Disclosure mailing list post.

Detection Methods for CVE-2025-10549

Indicators of Compromise

New or unexpected DLL files appearing in the Controlio installation directory with timestamps that do not match the installer or official update packages
DLL files in the Controlio folder signed by an untrusted publisher, or unsigned, while neighboring binaries carry an EfficientLab signature
Child processes spawned by the Controlio SYSTEM service that do not match documented product behavior

Detection Strategies

Audit ACLs on the Controlio installation directory and alert when non-administrative principals hold WriteData, AppendData, or WriteAttributes rights
Enable Sysmon Event ID 7 (Image Loaded) and flag DLL loads by the Controlio service from paths outside the expected version-pinned subdirectory
Correlate file create events (Sysmon Event ID 11) in the Controlio directory with subsequent service start events to surface plant-and-restart sequences

Monitoring Recommendations

Track service restart events for the Controlio agent on managed endpoints and review preceding file system writes
Inventory installed Controlio versions across the estate and flag any host below v1.3.95
Forward endpoint telemetry to a centralized data lake to retain historical evidence of DLL plants even after the staging file is removed

How to Mitigate CVE-2025-10549

Immediate Actions Required

Upgrade every Controlio client to v1.3.95 or later using the vendor's update channel
Manually correct ACLs on the Controlio installation directory so only Administrators and SYSTEM retain write access until the upgrade is applied
Review the installation directory for unauthorized DLLs and remove any file not shipped by the vendor

Patch Information

EfficientLab addressed the issue in Controlio client v1.3.95, released on April 15, 2026. Patch details and download instructions are available in the Controlio Client Update knowledge base article.

Workarounds

Restrict write access on the Controlio installation directory to privileged groups using icacls and remove inherited entries for Users or Authenticated Users
Apply application control policies (WDAC or AppLocker) that block unsigned or unapproved DLLs from loading inside privileged service processes
Where the agent is not required, stop and disable the Controlio service until the patched version can be deployed

bash

# Configuration example: harden ACLs on the Controlio installation directory
icacls "C:\Program Files\Controlio" /inheritance:r
icacls "C:\Program Files\Controlio" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
icacls "C:\Program Files\Controlio" /remove "Authenticated Users"