EUVD-2025-209578Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local escalation requires an existing low-priv session (PR:L, AV:L); the elevated dialog crosses into the OS admin context (S:C) yielding total confidentiality, integrity and availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-supplied paths with elevated permissions, which can be exploited by a local attacker to perform actions with administrator-level privileges.
AnalysisAI
Local privilege escalation in the Fan Control (FanControl) desktop application V251 for Windows allows a low-privileged local user to gain administrator-level execution by abusing the application's Open File Dialog, which processes user-supplied paths under the app's elevated security context (CWE-269). Because Fan Control requires elevated permissions to access hardware sensors and fan controllers, an attacker who can interact with the running elevated instance can pivot from limited user rights to full SYSTEM/administrator control. There is no public exploit identified in the structured input, though a referenced GitHub gist likely contains a technical write-up; EPSS is very low (0.01%) and CISA SSVC lists exploitation status as none, indicating no observed in-the-wild activity.
Technical ContextAI
Fan Control is an open-source Windows fan/hardware-monitoring utility (built on LibreHardwareMonitorLib) that must run with elevated privileges to read sensors and drive PWM/fan controllers. The flaw is a CWE-269 Improper Privilege Management issue: the standard Windows Open File Dialog (common file picker) invoked by the elevated process does not drop privileges, so operations initiated through it (path resolution, and in classic variants of this bug, launching child processes or shell actions via the dialog's address bar/right-click context menu) inherit the parent's administrator token. This is the well-known 'elevated file dialog' privilege-escalation pattern where a trusted UI element bridges a low-integrity user action into a high-integrity execution context. The provided CPE string is a placeholder (cpe:2.3:a:n/a:n/a) and does not identify the product programmatically, so version scoping relies on the CVE/EUVD text naming V251.
RemediationAI
No vendor-released patched version is identified in the available data; the V251 release notes (https://github.com/Rem0o/FanControl.Releases/releases/tag/V251) address unrelated changes (LibreHardwareMonitorLib update, storage interval, app code-signing) and do not cite a fix for this issue, so treat remediation as 'No vendor-released patch identified at time of analysis' and monitor the project releases page for a corrected build. As compensating controls: restrict local/interactive access to systems where Fan Control runs so untrusted users cannot reach the running elevated GUI; run the machine's day-to-day account as a standard user and avoid leaving an elevated Fan Control session accessible on shared or kiosk systems; where feasible run Fan Control only under trusted administrative sessions rather than auto-starting it elevated for all logged-in users (trade-off: fan curves will not apply for non-admin sessions). Because the escalation stems from the elevated file dialog, avoid invoking file-browse operations in the app while it holds administrator rights, and consider application allow-listing (e.g., WDAC/AppLocker) to block child-process spawning from the utility (trade-off: may interfere with legitimate plugin/config file selection).
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today