ControlFLASH CVE-2026-12663

The attacker must have an active local user account on the target Windows machine - confirmed by CVSS PR:L (low privilege required) and AV:L (local attack vector). The 'Everyone' group write permission on the installation directory is the enabling condition: this is a non-default-in-security-terms but installer-created misconfiguration present on any system where ControlFLASH has been installed. A second user (UI:P - passive interaction) must subsequently launch the ControlFLASH application for the malicious payload to execute; the attacker cannot force this action remotely. Exploitation is limited by: (1) required prior local access, ruling out remote unauthenticated attacks; (2) dependency on another user running the application, introducing a timing and social-engineering constraint; and (3) execution at the victim user's privilege level rather than SYSTEM, capping the immediate impact to whatever rights that account holds.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, score 7.0) accurately captures the threat profile: attack is local, complexity is low once access is obtained, exploitation requires a low-privileged account, and a user interaction step (the victim launching ControlFLASH) is required. The High C/I/A impact on the vulnerable system is credible given arbitrary code execution at the invoking user's permission level. The absence of any subsequent-system (SC/SI/SA) impact in the vector reflects execution staying within the user's own session context, though in practice an OT engineer account with device-programming rights could represent significant indirect impact on connected PLCs and field equipment. No EPSS data was provided and the vulnerability is not in the CISA KEV catalog, indicating no known active exploitation. The 'Authentication Bypass' tag in the source data appears to derive from the CWE-306 mapping but is misleading - this is not a classic auth bypass but a filesystem permission misconfiguration; security teams should not conflate these. Real-world risk is moderate: exploitation requires an attacker who already has local system access and must wait for or socially engineer a target user to run ControlFLASH, limiting opportunistic mass exploitation.

A low-privileged attacker who has obtained local access to an engineering workstation - via phishing, a compromised contractor account, or lateral movement from the IT network - locates the ControlFLASH installation directory and replaces or adds a malicious DLL that the application loads at startup. When an OT engineer subsequently launches ControlFLASH to perform routine firmware updates on field devices, the malicious code executes silently at the engineer's privilege level, which may include rights to communicate with and reprogram connected PLCs and drives. No public proof-of-concept code has been identified, but the technique is well-understood and requires no special tooling beyond directory write access.