Which versions of Eluktronics Control Center are affected by CVE-2025-7883?

Eluktronics Control Center 5.23.51.41 contains a command injection vulnerability that allows authenticated local users to escalate privileges and execute arbitrary commands on affected systems.

How to fix or mitigate CVE-2025-7883?

Within 24 hours: Inventory all systems running Eluktronics Control Center 5.23.51.41 and restrict local administrative access to trusted users only. Within 7 days: Implement application whitelisting or disable the AiStoneService component if not operationally required; escalate to the vendor with formal remediation demand including timelines. Within 30 days: Evaluate replacement with patched versions or alternative hardware control solutions; conduct privilege access reviews on affected systems to detect unauthorized escalation attempts.

Eluktronics Control Center CVE-2025-7883

Q: What is the CVSS score of CVE-2025-7883?

CVE-2025-7883 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-20 cna@vuldb.com

Command Injection Control Center

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:15 vuln.today

DescriptionCVE.org

A vulnerability classified as critical has been found in Eluktronics Control Center 5.23.51.41. Affected is an unknown function of the file \AiStoneService\MyControlCenter\Command of the component Powershell Script Handler. The manipulation leads to command injection. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in Eluktronics Control Center 5.23.51.41 allows local authenticated users to execute arbitrary PowerShell commands with elevated privileges through the AiStoneService component. The vulnerability has public exploit code available (CVSS E:P) and affects a PC hardware control software, enabling local privilege escalation. Vendor was notified but did not respond, leaving the vulnerability unpatched. EPSS data not available, but the local-only attack vector (AV:L) and authentication requirement (PR:L) limit widespread exploitation risk despite the critical CVSS 7.1 score.

Technical ContextAI

The vulnerability resides in the PowerShell Script Handler component of Eluktronics Control Center, specifically in the AiStoneService at path \AiStoneService\MyControlCenter\Command. This is a CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) injection flaw, where the application fails to sanitize user-controlled input before passing it to PowerShell execution contexts. Eluktronics Control Center is a system utility for managing laptop hardware settings (fan curves, performance profiles, RGB lighting) on Eluktronics gaming laptops. The affected CPE (cpe:2.3:a:eluktronics:control_center:5.23.51.41) identifies version 5.23.51.41 specifically. The AiStoneService component likely runs with elevated system privileges to modify hardware settings, making command injection particularly dangerous as it can bypass Windows User Account Control and execute commands in a SYSTEM or administrator context.

RemediationAI

No vendor-released patch is available as Eluktronics did not respond to vulnerability disclosure. Immediate compensating controls: (1) Uninstall Eluktronics Control Center version 5.23.51.41 if hardware control features are not business-critical-this eliminates the attack surface but loses fan control and performance tuning capabilities. (2) Restrict local user privileges on affected systems to prevent standard users from accessing the AiStoneService component-implement least-privilege access controls and remove local administrator rights where possible, though this may limit legitimate hardware configuration. (3) Deploy application whitelisting (AppLocker, Windows Defender Application Control) to block execution of unauthorized PowerShell scripts, though this may interfere with legitimate Control Center operations. (4) Monitor process execution for suspicious PowerShell commands spawned by AiStoneService.exe or related Eluktronics processes using EDR telemetry. Users should check Eluktronics support channels or third-party laptop communities for any unofficial patches or updated software versions. Public exploit details available at https://drive.proton.me/urls/V5KQBBTH4G#VKpByTUTOWUW and VulDB entries 316998.