CVE-2026-16003

CVE-2026-16003 affects the ASUS Armoury Crate driver , which exposes an IOCTL interface with insufficient access control . A local user with low privileges can craft an IOCTL request to bypass the driver's verification and add an arbitrary process identifier to the driver's whitelist . The CVSS 4...

EUVD-2026-72624

Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request by bypassing the driver's verification.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS...

CVE-2026-16004

Armoury Crate driver (ASUS) contains an exposed IOCTL with insufficient access control that allows a local user with low privileges to read and write arbitrary PCI/PCIe configuration space by crafting IOCTL requests that bypass the driver's verification. The CVSS 4.0 base score is 5.8 (MEDIUM) , ...

EUVD-2026-72619

Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the ' Security Update for Armoury...

kur

kur 这是一个简单的代码，可利用存在漏洞的已签名驱动程序，从用户模式进行内核模式内存读写。 它仅仅是在内核模式下利用 MmCopyVirtualMemory（一个未公开但最常见的 API 之一），从而无需担心内存页的保护机制，即可读取/写入任意用户模式内存。此外，它还附带一个函数，用于获取给定 PID 的进程句柄作为辅助功能。由于句柄的创建在内核模式下进行，我相信标准的访问检查和回调不会被触发。 本项目仅用于学习目的，不建议在虚拟机之外的环境中使用。 background 我在 uc 论坛上看到，这个特定驱动程序存在提权漏洞。 于是我开始亲自逆向该驱动程序，果然该驱动程序对其强大的...

CVE-2025-27535

Exposed ioctl with insufficient access control in the firmware for some IntelR Ethernet Connection E825-C. before version NVM ver. 3.84 within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable...

Intel Ethernet Connection E825-C 安全漏洞

The Intel Ethernet Connection E825-C is a series of network controllers developed by the American company Intel. Versions of Intel Ethernet Connection E825-C prior to NVM ver. 3.84 contain security vulnerabilities. These vulnerabilities stem from insufficient ioctl access control, which may lead ...

CVE-2023-35841

Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0...

PHOENIX CONTACT TdkLib64.sys 安全漏洞

PHOENIX CONTACT TdkLib64.sys is a core application from PHOENIX CONTACT, Germany. A security vulnerability exists in PHOENIX CONTACT TdkLib64.sys, which stems from the vulnerability of TdkLib64.sys to insufficient IOCTL access control, where by sending a specific IOCTL request, an attacker withou...