CVE-2025-10549: EfficientLab Controlio DLL Hijacking RCE

CVE-2025-10549 Overview

EfficientLab Controlio before version v1.3.95 contains a DLL hijacking vulnerability (CWE-427) caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\SYSTEM.

Critical Impact

Local privilege escalation to SYSTEM-level access through DLL hijacking, enabling complete system compromise.

Affected Products

• EfficientLab Controlio versions prior to v1.3.95

Discovery Timeline

• 2026-04-23 - CVE CVE-2025-10549 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-10549

Vulnerability Analysis

This vulnerability stems from insecure folder permissions on the Controlio installation directory combined with the application running as a highly privileged Windows service. When Windows applications load DLLs, they follow a specific search order. If an application's installation directory has weak permissions allowing local users to write files, an attacker can place a malicious DLL with the same name as a legitimately loaded library. When the Controlio service starts or loads the DLL, the malicious code executes with the service's privileges.

Because the Controlio service operates under the NT AUTHORITY\SYSTEM account, successful exploitation grants the attacker the highest level of privileges on the Windows system. This enables complete compromise including credential theft, persistence establishment, and lateral movement within the network.

Root Cause

The root cause is improper access control on the Controlio installation directory (CWE-427: Uncontrolled Search Path Element). The installation process fails to properly restrict write permissions to the application directory, allowing non-administrative users to place files in locations searched by the privileged service during DLL loading operations.

Attack Vector

The attack requires local access to the target system. An attacker with limited user privileges can:

1. Identify DLLs loaded by the Controlio service by monitoring process activity or analyzing the application
2. Create a malicious DLL that exports the same functions as the legitimate library
3. Place the malicious DLL in the Controlio installation directory
4. Wait for the Controlio service to restart or trigger a DLL load operation
5. The malicious code executes with SYSTEM privileges

Since no proof-of-concept code is available, the specific DLL names and exploitation methodology would require analysis of the Controlio application. Refer to the SEC Consult Security Report for additional technical details.

Detection Methods for CVE-2025-10549

Indicators of Compromise

• Unexpected DLL files appearing in the Controlio installation directory
• Modifications to the Controlio installation folder by non-administrative users
• Unusual process activity spawned from the Controlio service process
• Windows Event Log entries indicating service crashes or restarts

Detection Strategies

• Monitor file system changes to the Controlio installation directory using endpoint detection tools
• Enable Windows process creation auditing to detect suspicious child processes from the Controlio service
• Implement application whitelisting to prevent unauthorized DLLs from loading
• Use SentinelOne's Vigilance service for real-time threat hunting and anomaly detection

Monitoring Recommendations

• Configure endpoint protection to alert on DLL loading anomalies for the Controlio service
• Establish baseline behavior for the Controlio application and alert on deviations
• Review access control lists on the Controlio installation directory periodically

How to Mitigate CVE-2025-10549

Immediate Actions Required

• Update EfficientLab Controlio to version v1.3.95 or later immediately
• Review and restrict folder permissions on the Controlio installation directory
• Audit systems for unauthorized DLL files in the Controlio installation path
• Enable enhanced monitoring on systems where immediate patching is not possible

Patch Information

EfficientLab has released version v1.3.95 which addresses this DLL hijacking vulnerability. Organizations should update to this version or later to remediate the issue. Detailed patch information is available in the Controlio Client Update advisory.

Workarounds

• Manually restrict write permissions on the Controlio installation directory to Administrators and SYSTEM only
• Implement application control policies to prevent unauthorized DLLs from executing
• Use Windows Defender Application Control (WDAC) or similar solutions to enforce code integrity
• Consider network segmentation to limit exposure of vulnerable systems

# PowerShell command to restrict folder permissions on Controlio installation directory
# Replace path with actual Controlio installation location
$path = "C:\Program Files\EfficientLab\Controlio"
$acl = Get-Acl $path
$acl.SetAccessRuleProtection($true, $false)
$adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$acl.AddAccessRule($adminRule)
$acl.AddAccessRule($systemRule)
Set-Acl $path $acl