Executive brief
The HP Fan Control App, a utility used to manage hardware cooling on HP computers, contains a security flaw that could allow a local user to gain elevated system privileges. If exploited, an attacker who already has basic access to a computer could take full control of the system, potentially accessing sensitive data or installing malicious software. HP has released an updated version of the application to address this issue.
Technical details
The HP Fan Control App is vulnerable to a local privilege escalation due to an unquoted search path (CWE-428). This occurs when a service path contains spaces and is not enclosed in quotation marks, allowing a local attacker with low privileges to place a malicious executable in the search path (e.g., C:\Program.exe). When the system attempts to launch the legitimate service, it may execute the attacker's file instead, granting the attacker the privileges of the service account (typically SYSTEM). The vulnerability affects versions prior to 1.0.0.2 on Windows platforms. HP has released version 1.0.0.2 to resolve the issue.
Affected products
- HP Inc. Fan Control App versions prior to 1.0.0.2
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory