Eluktronics Control Center CVE-2025-7884

Q: What is the CVSS score of CVE-2025-7884?

CVE-2025-7884 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Insufficient Verification of Data Authenticity (CWE-345)

2025-07-20 cna@vuldb.com

Information Disclosure Control Center

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:24 vuln.today

DescriptionCVE.org

A vulnerability classified as problematic was found in Eluktronics Control Center 5.23.51.41. Affected by this vulnerability is an unknown functionality of the component REG File Handler. The manipulation leads to insufficient verification of data authenticity. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Eluktronics Control Center 5.23.51.41 permits local authenticated users to bypass data authenticity verification in the REG File Handler component, resulting in potential information disclosure. The vulnerability requires local access and authenticated privileges but carries minimal real-world impact given the CVSS 1.9 score and EPSS exploitation probability of 0.01% (third percentile). Public exploit code has been disclosed, though vendor has not responded to disclosure notifications.

Technical ContextAI

The vulnerability resides in the REG File Handler component of Eluktronics Control Center, a system utility software for managing laptop hardware and performance settings. The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity), indicating the component fails to properly validate the integrity or authenticity of registry file data it processes. The affected component likely handles Windows Registry files (.reg format) during import, export, or modification operations. An authenticated local user can manipulate registry file inputs to bypass signature or integrity checks, allowing unauthorized modification or inspection of sensitive configuration data. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) confirms the attack requires local access to the system and authenticated user privileges, with no user interaction required, but impact is limited to integrity of information rather than confidentiality or availability.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to early disclosure notification. Users of Eluktronics Control Center 5.23.51.41 should consider the following compensating controls: restrict local system access to trusted users only, enforce strong authentication (complex passwords, multi-factor authentication if available) to reduce the likelihood of unauthorized local login; disable or restrict the REG File Handler component if not actively used in your deployment, as disabling unused functionality eliminates the attack surface; monitor Registry import and export operations through Windows Event Viewer or endpoint detection tools to detect suspicious REG file manipulation attempts; apply Windows Group Policy restrictions to prevent non-administrative users from modifying HKEY_LOCAL_MACHINE registry hives, which may prevent malicious registry file imports; regularly audit user permissions on systems running Control Center to ensure principle of least privilege. Given the minimal CVSS and EPSS scores, patching this vulnerability is lower priority than addressing higher-severity issues, but these controls are low-cost to implement.