Exposed IOCTL with Insufficient Access Control
CWE-782
The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
When an IOCTL contains privileged functionality and is exposed unnecessarily, attackers may be able to access this functionality by invoking the IOCTL. Even if the functionality is benign, if the programmer has assumed that the IOCTL would only be accessed by a trusted process, there may be little or no validation of the incoming data, exposing weaknesses that would never be reachable if the attacker cannot call the IOCTL directly. The implementations of IOCTLs will differ between operating system types and versions, so the methods of attack and prevention may vary widely.
We track 29 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: In Windows environments, use proper access control for the associated device or device namespace. See References.
Latest Exposed IOCTL with Insufficient Access Control vulnerabilities
- 8.2 High severity
FURY CTRL RGB Control Software: Exposed IOCTL with Insufficient Access Control
A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.0. The impacted element is an unknown function in the library NTIOLib_X64.sys of the component IOCTL Handler. Performing a manipulation results in exposed ioctl with insufficient
- 7.8 High severity
TcRouter.sys for Windows on x64 3.1.0.2364: Exposed IOCTL with Insufficient Access Control
A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
- 7.8 High severity
TcRouter.sys for Windows on x64 3.1.0.2364: Exposed IOCTL with Insufficient Access Control
A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
- 7.8 High severity
TcRouter.sys for Windows on x64 3.1.0.2364: Exposed IOCTL with Insufficient Access Control
A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.
- 8.5 High severity
System Control Interface: Exposed IOCTL with Insufficient Access Control
An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the aff
- 8.4 High severity
Core Temp: Exposed IOCTL with Insufficient Access Control
The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical memory to be read or written.
- 8.7 High severity
QND Premium: Exposed IOCTL with Insufficient Access Control
QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges.
- 7.1 High severity
PerformanceTest: Exposed IOCTL with Insufficient Access Control
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to issue arbitrary IN and OUT instructions to any
- 7.8 High severity
PerformanceTest: Exposed IOCTL with Insufficient Access Control
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by exploiting exp
- 7.1 High severity
PerformanceTest: Exposed IOCTL with Insufficient Access Control
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory add
- 7.8 High severity
MBStorage: Exposed IOCTL with Insufficient Access Control
The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bu
- 7.8 High severity
KernCoreLib64.sys: Exposed IOCTL with Insufficient Access Control
MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCT
- 8.5 High severity
ExpressUpdate Agent for Windows: Exposed IOCTL with Insufficient Access Control
An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a malicious user gains access to the product, arbitrary code could be executed with SYSTEM privileges.
- 7.8 High severity
PC Tools Internet Security: Exposed IOCTL with Insufficient Access Control
Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or
- 7.0 High severity
MxGeneralIo: Exposed IOCTL with Insufficient Access Control
An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGeneralIo, exposes IOCTL methods that permit direct read and write access to MSR an
- 7.8 High severity
FortiClientWindows: Exposed IOCTL with Insufficient Access Control
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips dr
- 7.0 High severity
Dispatcher 3.0 Driver: Exposed IOCTL with Insufficient Access Control
A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenovo consumer notebooks that could allow an authenticated local user to execute code with elevated privileges. The Lenovo
- 8.7 High severity
ThrottleStop: Exposed IOCTL with Insufficient Access Control
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the run
- 10.0 Critical severity
control_center: Exposed IOCTL with Insufficient Access Control
An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, execute arbitrary code, or escalate privileges via sending crafted IOCTL requests.
- 9.8 Critical severity
IP Office: Exposed IOCTL with Insufficient Access Control
An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.
- 8.4 High severity
atszio_driver: Exposed IOCTL with Insufficient Access Control
An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 7.8 High severity
bios_flash_driver: Exposed IOCTL with Insufficient Access Control
An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 8.8 High severity
aisuite3: Exposed IOCTL with Insufficient Access Control
An issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 7.8 High severity
sabertooth_x99_driver: Exposed IOCTL with Insufficient Access Control
An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 7.8 High severity
usb3.0_boost_storage_driver: Exposed IOCTL with Insufficient Access Control
An issue in the component AsUpIO64.sys of ASUSTeK Computer Inc ASUS USB 3.0 Boost Storage Driver 5.30.20.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
- 7.8 High severity
WinFlash Driver: Incorrect Permission Assignment for Critical Resource
Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.
- 9.8 Critical severity
mailinspector: Exposed IOCTL with Insufficient Access Control
An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the mliSystemUsers.php component.
- 9.8 Critical severity
fan_xpert: Exposed IOCTL with Insufficient Access Control
An issue discovered in the DeviceIoControl component in ASUS Fan_Xpert before v.10013 allows an attacker to execute arbitrary code via crafted IOCTL requests.
- 7.8 High severity
Dell dbutil Driver Insufficient Access Control Exploited
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.