PT-2026-34644 · Efficientlab · Controlio

Published 2026-04-23 · Updated 2026-04-23 · CVE-2025-10549

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions EfficientLab Controlio versions prior to 1.3.95

Description Weak folder permissions in the installation directory allow a local attacker to place a specially crafted DLL in the directory. This can lead to arbitrary code execution with the highest privileges because the affected service runs as NT AUTHORITYSYSTEM. DLL hijacking is a technique where an application is tricked into loading a malicious DLL instead of the intended one.

Recommendations Update to version 1.3.95 or later.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-10549

Affected Products

Controlio

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10549 · Security Note
• http://seclists.org/fulldisclosure/2026/Apr/19 · Note
• https://twitter.com/CVEnew/status/2047359873399034340 · Twitter Post
• https://r.sec-consult.com/controlio · Note
• https://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95 · Note