Executive brief
EfficientLab Controlio, a cloud-based employee monitoring service, is vulnerable to a security flaw that allows a local user to gain full control over a computer. By placing a malicious file in the software's installation folder, an attacker can execute commands with the highest system privileges. This could allow an unauthorized user to bypass monitoring, steal data, or disable security protections on the affected machine.
Technical details
A DLL hijacking vulnerability exists in EfficientLab Controlio versions prior to 1.3.95 due to an uncontrolled search path (CWE-427) and weak directory permissions. The application attempts to load several non-existent system DLLs (such as version.dll, WER.dll, and winhttp.dll) from its installation directory located in C:\ProgramData\{UUID}. Because the default folder permissions allow local users to create new files, an attacker can place a malicious DLL in this directory. When the Controlio service restarts, it loads the attacker's DLL and executes arbitrary code with NT AUTHORITY\SYSTEM privileges. The issue is resolved in version 1.3.95.
Affected products
- EfficientLab Controlio before 1.3.95
Timeline
- 2025-05-20: other: Vulnerability discovered by SEC Consult
- 2025-09-17: disclosed: Advisory submitted to vendor bug bounty program
- 2026-04-15: patched: Vendor released version 1.3.95
- 2026-04-23: advisory: Coordinated public advisory release