EUVD-2025-209578Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged local access
-
DeliveryInteract with elevated FanControl GUI
-
ExploitOpen File Dialog processes attacker path
-
ExecutionPerform action under administrator token
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a Windows host on which Fan Control V251 is running with elevated/administrator privileges (its normal operating mode, since hardware fan control needs elevation), and the ability to interact with the application's Open File Dialog, which processes user-supplied paths in that elevated context. Limiting factors: the attack is local only (no network vector), the attacker needs an existing low-privilege session or interactive access to the machine (PR:L), and it depends on the elevated Fan Control instance being present and reachable through its GUI. It cannot be triggered remotely or against a host where the application is not running with elevated rights. |
| Impact | The signals are consistent but modest in urgency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.8) reflects a genuinely high technical impact (total compromise via scope change to administrator) but is gated by local access (AV:L) and requiring an existing low-privilege foothold (PR:L). EPSS is 0.01% (2nd percentile) and CISA SSVC reports Exploitation: none, Automatable: no, Technical Impact: total - meaning full impact if exploited, but no evidence of active or automatable exploitation. This aligns: a local-only privilege-escalation bug in a consumer utility is a real post-compromise escalation tool, not a mass-exploitation or remote threat. The high 8.8 base score should not be read as internet-facing risk. One caveat: the CVSS marks UI:N, yet abusing a file dialog realistically involves attacker-driven interaction with the elevated GUI - verify the exploitation mechanics against the referenced gist before treating it as fully non-interactive. |
| Exploit ScenarioDerived | An attacker with a limited local account (or physical access to an unlocked shared workstation) opens an already-elevated Fan Control V251 instance, triggers its Open File Dialog, and uses the dialog to resolve or launch a path/executable that then runs with administrator privileges. This yields full control of the host from an initially restricted context. A referenced GitHub gist appears to document the technique, though no confirmed weaponized exploit is asserted in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Local privilege escalation in the Fan Control (FanControl) desktop application V251 for Windows allows a low-privileged local user to gain administrator-level execution by abusing the application's Open File Dialog, which processes user-supplied paths under the app's elevated security context (CWE-269). Because Fan Control requires elevated permissions to access hardware sensors and fan controllers, an attacker who can interact with the running elevated instance can pivot from limited user rights to full SYSTEM/administrator control. There is no public exploit identified in the structured input, though a referenced GitHub gist likely contains a technical write-up; EPSS is very low (0.01%) and CISA SSVC lists exploitation status as none, indicating no observed in-the-wild activity.
RemediationAI
No vendor-released patched version is identified in the available data; the V251 release notes (https://github.com/Rem0o/FanControl.Releases/releases/tag/V251) address unrelated changes (LibreHardwareMonitorLib update, storage interval, app code-signing) and do not cite a fix for this issue, so treat remediation as 'No vendor-released patch identified at time of analysis' and monitor the project releases page for a corrected build. As compensating controls: restrict local/interactive access to systems where Fan Control runs so untrusted users cannot reach the running elevated GUI; run the machine's day-to-day account as a standard user and avoid leaving an elevated Fan Control session accessible on shared or kiosk systems; where feasible run Fan Control only under trusted administrative sessions rather than auto-starting it elevated for all logged-in users (trade-off: fan curves will not apply for non-admin sessions). Because the escalation stems from the elevated file dialog, avoid invoking file-browse operations in the app while it holds administrator rights, and consider application allow-listing (e.g., WDAC/AppLocker) to block child-process spawning from the utility (trade-off: may interfere with legitimate plugin/config file selection).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fan Control is an open-source Windows fan/hardware-monitoring utility (built on LibreHardwareMonitorLib) that must run with elevated privileges to read sensors and drive PWM/fan controllers. The flaw is a CWE-269 Improper Privilege Management issue: the standard Windows Open File Dialog (common file picker) invoked by the elevated process does not drop privileges, so operations initiated through it (path resolution, and in classic variants of this bug, launching child processes or shell actions via the dialog's address bar/right-click context menu) inherit the parent's administrator token. This is the well-known 'elevated file dialog' privilege-escalation pattern where a trusted UI element bridges a low-integrity user action into a high-integrity execution context. The provided CPE string is a placeholder (cpe:2.3:a:n/a:n/a) and does not identify the product programmatically, so version scoping relies on the CVE/EUVD text naming V251.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local escalation requires an existing low-priv session (PR:L, AV:L); the elevated dialog crosses into the OS admin context (S:C) yielding total confidentiality, integrity and availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-supplied paths with elevated permissions, which can be exploited by a local attacker to perform actions with administrator-level privileges.
Executive ViewAI
Fan Control V251 for Windows contains a critical local privilege escalation vulnerability (CVSS 8.8) that allows low-privileged users to gain full administrator access through an Open File Dialog flaw. This directly undermines Windows access controls and could enable attackers to install malware, steal credentials, or establish persistence on affected systems. Organizations running Fan Control for hardware monitoring should assess exposure immediately, particularly on systems with multiple user accounts or in shared IT environments.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce administrator-only execution via AppLocker or WDAC; disable Fan Control if not operationally critical; monitor Windows Event Viewer for suspicious privilege escalation events; implement network segmentation to isolate systems running Fan Control; use just-in-time privileged access provisioning for users requiring hardware monitoring capabilities; restrict physical and remote access to affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB