CVE-2025-9016
π TL;DR
This vulnerability in Mechrevo Control Center allows local attackers to exploit an uncontrolled search path (DLL hijacking) in the PowerShell Script Handler component. Attackers with local access could potentially execute arbitrary code with elevated privileges. Only users running the specific affected software version are impacted.
π» Affected Systems
- Mechrevo Control Center GX
π¦ What is this software?
β οΈ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, installation of persistent malware, or data exfiltration.
Likely Case
Local attacker gains elevated privileges to install unwanted software, modify system settings, or access restricted data.
If Mitigated
Limited impact due to proper access controls, application whitelisting, and restricted local user privileges.
π― Exploit Status
Exploit details are publicly available but exploitation requires local access and specific conditions. Attack complexity is rated as high.
π οΈ Fix & Mitigation
β Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
Check Mechrevo website for updated version. If available, download and install the latest Control Center version.
π§ Temporary Workarounds
Restrict PowerShell Execution
windowsConfigure PowerShell execution policy to restrict script execution
Set-ExecutionPolicy Restricted -Scope LocalMachine
Remove Vulnerable Component
windowsUninstall or disable the vulnerable Control Center component
π§― If You Can't Patch
- Implement strict local user privilege restrictions
- Enable application whitelisting to prevent unauthorized executables
π How to Verify
Check if Vulnerable:
Check if C:\Program Files\OEM\ζΊζ’°ι©ε½ζ§εΆδΈεΏ\AiStoneService\MyControlCenter\Command exists and verify Control Center version is 5.56.51.48Check Version:
Check Control Center About section or examine installed programs listVerify Fix Applied:
Verify Control Center version is updated beyond 5.56.51.48 or vulnerable component is removedπ‘ Detection & Monitoring
Log Indicators:
- Unusual PowerShell script execution from Control Center directory
- Process creation from suspicious locations
Network Indicators:
- None - local vulnerability only
SIEM Query:
Process creation where parent process contains 'ControlCenter' and child process is powershell.exe from unusual paths