Eluktronics Control Center CVE-2025-7884

Attack requires the following specific conditions: (1) authenticated local user account on the target system running Eluktronics Control Center 5.23.51.41; (2) the REG File Handler component must be functional and accessible to the authenticated user; (3) the user must have file system read/write access to provide input to the handler (e.g., ability to place a crafted .reg file in an import directory or import via UI). No network access is possible. No special non-default configuration is required - default installations are vulnerable if the authenticated user has standard file access. The limiting factors are: (a) authentication requirement (PR:L in CVSS) means unauthenticated remote attackers cannot exploit this; (b) local-only attack vector (AV:L) restricts to local users or those with local system access; (c) minimal integrity impact (VI:L only) means modification scope is limited, reducing real-world harm.

This vulnerability presents minimal real-world risk despite public disclosure. Multiple signals align on low priority: CVSS score of 1.9 places it in the negligible severity range (CVSS 4.0 scale); EPSS score of 0.01% (third percentile) indicates extremely low probability of exploitation relative to other CVEs; and the attack vector strictly requires local authenticated access, eliminating remote exploitation risk. The CVSS vector shows integrity impact only (VI:L) with no confidentiality or availability impact, meaning potential damage is limited to modification of registry configuration data. While public exploit code exists (E:P flag), the combination of authentication requirements, local-only vector, and minimal impact significantly reduces operational urgency. SSVC framework would classify this as low priority: exploitation is possible but not automatic; technical impact is limited; and remediation requires authenticated access. The disconnect between public disclosure and vendor non-response is notable but does not elevate real exploitation probability. Defenders should prioritize other CVEs with higher EPSS scores and broader attack vectors. This is an example of a high-public-visibility but low-actual-risk issue.

An authenticated local user with standard user privileges logs into a system running Eluktronics Control Center 5.23.51.41 and crafts a malicious .reg (registry) file containing modified configuration values. The user imports this file into the Control Center's REG File Handler component, which fails to verify the file's authenticity or detect tampering. The malicious registry entries are applied without integrity checks, potentially modifying Control Center or system settings. A more sophisticated attacker with local access could use this to escalate privileges by modifying protected registry keys, though the CVE description indicates integrity impact only, not privilege escalation.