Executive brief
CoolerControl is a system utility used to monitor and manage hardware cooling, such as fan speeds and liquid coolers. A security flaw allows an authorized user to take complete control of the underlying operating system by including malicious commands in the names of system alerts. This could lead to a total compromise of the machine, allowing an attacker to access sensitive data or disrupt operations with administrative privileges.
Technical details
An OS command injection vulnerability (CWE-78) exists in CoolerControl's daemon, coolercontrold, specifically within the alert handling logic in alerts.rs. The vulnerability is triggered when the application fails to properly sanitize alert names before passing them to a shell for execution. An authenticated attacker with high privileges can inject Bash commands into an alert name to achieve arbitrary code execution with root privileges. This issue affects versions starting from 3.1.0 and is fixed in version 4.0.0. While some assessments suggest a network vector, the primary risk involves local privilege escalation or exploitation via the management interface.
Affected products
- CoolerControl coolercontrold >= 3.1.0, < 4.0.0
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in version 4.0.0