Vulnerabilities

TI-2025-09654 CVE-2025-10549 · GHSA-hhv5-qpmh-pc66

DLL Hijacking in EfficientLab Controlio Leads to Local Privilege Escalation

LOW 22

EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory.

CVSS 3.1MEDIUM 5.1 Local High privileges No interaction EPSS 0.00163 Published 2026-04-23 Fixed in 1.3.95 CWE-427

TI-2025-09741 CVE-2025-10641 · GHSA-6pj2-4cj6-vf8f

Unencrypted cleartext communication in EfficientLab WorkExaminer Professional

LOW 31

All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00315 Published 2025-10-21 No fix listed CWE-319

TI-2025-09740 CVE-2025-10640 · GHSA-8xf9-xq28-hpj9

Missing Server-Side Authentication Checks in EfficientLab WorkExaminer Professional

MEDIUM 51

An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional console to gain admin…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00901 Published 2025-10-21 No fix listed CWE-602

TI-2025-09739 CVE-2025-10639 · GHSA-78gv-jfcm-9w8v

Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional

MEDIUM 42

The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00932 Published 2025-10-21 No fix listed CWE-798

Vulnerabilities

Filters

DLL Hijacking in EfficientLab Controlio Leads to Local Privilege Escalation

Unencrypted cleartext communication in EfficientLab WorkExaminer Professional

Missing Server-Side Authentication Checks in EfficientLab WorkExaminer Professional

Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional