Eluktronics Control Center CVE-2025-7883

Requires authenticated local access to a Windows system running Eluktronics Control Center version 5.23.51.41 with low-privilege user account (PR:L in CVSS vector). The attacker must be able to interact with the AiStoneService component through the Control Center interface at path \AiStoneService\MyControlCenter\Command, which is accessible to standard authenticated users. No network access required (AV:L), no user interaction needed (UI:N), and attack complexity is low (AC:L), meaning exploitation is straightforward once local access is obtained. Limits to exploitation: Windows Defender or EDR solutions may detect malicious PowerShell spawned from unexpected parent processes; application sandboxing or restricted PowerShell execution policies could prevent command injection success; vulnerability only exists on systems with Eluktronics Control Center installed, which is predominantly gaming laptops from Eluktronics/Tongfang ODM brands.

Real-world risk is moderate despite the CVSS 7.1 score. The CVSS vector shows local attack vector (AV:L), low complexity (AC:L), and low privileges required (PR:L), meaning an attacker needs existing local user access to the Windows system. The E:P (Proof-of-concept exploit exists) modifier confirms public exploit availability via the ProtonDrive reference. However, exploitation requires the attacker to already have authenticated access to a machine running this specific Eluktronics software, limiting the threat primarily to insider threats, physical access scenarios, or post-compromise privilege escalation chains. No EPSS score available to assess probabilistic exploitation likelihood. Not present in CISA KEV, suggesting no confirmed widespread exploitation. The unresponsive vendor status is concerning-no patch timeline exists, leaving users indefinitely vulnerable. Primary risk scenario: local malware or attacker with initial foothold uses this to escalate to SYSTEM privileges on Eluktronics laptops. For most enterprise environments not using Eluktronics hardware, risk is zero. For organizations with these devices, this becomes a privilege escalation vector that should be prioritized if users have untrusted local access.

An attacker with standard user credentials on an Eluktronics laptop opens the Control Center application and crafts a malicious command targeting the \AiStoneService\MyControlCenter\Command interface, injecting PowerShell metacharacters that break out of intended command syntax. The AiStoneService, running with elevated privileges to modify hardware settings, executes the injected PowerShell script without sanitization, granting the attacker SYSTEM-level code execution. The attacker can now install persistent backdoors, disable security tools, exfiltrate credentials, or pivot to other network systems. Public exploit code exists, lowering the skill barrier for local attackers.