EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\SYSTEM.

Affected: unknown SEC Consult SA-20260423-0

SEC Consult Vulnerability Lab Security Advisory < 20260423-0 > ======================================================================= title: DLL Hijacking product: EfficientLab Controlio (cloud-based employee monitoring service) vulnerable version: <1.3.95      fixed version: 1.3.95         CVE number: CVE-2025-10549             impact: High homepage:https://controlio.net found: 2025-05-20 by: Tobias Niemann (Office Bochum) Daniel Hirschberger Thorger Jansen (Office Bochum) Marius Renner (Office Berlin) SEC Consult Vulnerability Lab

An integrated part of SEC Consult, an Atos business Europe | Asia

https://www.sec-consult.com

=======================================================================

Vendor description: ------------------- "Controlio is a web-based cloud system for employee surveillance on their work PCs that run Windows or MAC. You can easily monitor web and application usage, and watch what’s happening on your staff screens live or on-demand. Check what they type, search on the Web, what files they copy and much more. The client app runs in stealth mode on a work computer, so your employees won’t see additional icons or processes. The system is free to try on three computers."

Source:https://controlio.net/what_is_controlio.html

Business recommendation: -…

EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\SYSTEM.