Exposed IOCTL with Insufficient Access Control

The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.

CVEs (45)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-21789 1Iobit 1Advanced Systemcare Ultimate Jun 17, 2026 Jul 7, 2021 N/A· v4 8.8 HIGH· v3 4.6 MEDIUM· v2 A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0e0, the first dword passed in the input buffer is th...Show more A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0e0, the first dword passed in the input buffer is the device port to write to and the dword at offset 4 is the value to write via the OUT instruction. A local attacker can send a malicious IRP to trigger this vulnerability.Show less
CVE-2021-21788 1Iobit 1Advanced Systemcare Ultimate Jun 17, 2026 Jul 7, 2021 N/A· v4 8.8 HIGH· v3 4.6 MEDIUM· v2 A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0dc, the first dword passed in the input buffer is th...Show more A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0dc, the first dword passed in the input buffer is the device port to write to and the word at offset 4 is the value to write via the OUT instruction. The OUT instruction can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users. A local attacker can send a malicious IRP to trigger this vulnerability.Show less
CVE-2021-21787 1Iobit 1Advanced Systemcare Ultimate Jun 17, 2026 Jul 7, 2021 N/A· v4 8.8 HIGH· v3 4.6 MEDIUM· v2 A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0d8, the first dword passed in the input buffer is th...Show more A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0d8, the first dword passed in the input buffer is the device port to write to and the byte at offset 4 is the value to write via the OUT instruction. The OUT instruction can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users.Show less
CVE-2021-21786 1Iobit 1Advanced Systemcare Ultimate Jun 17, 2026 Jul 7, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead to increased privileges. An attacker ca...Show more A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead to increased privileges. An attacker can send a malicious IRP to trigger this vulnerability.Show less
CVE-2021-21551 1Dell 1Dbutil Jun 17, 2026 May 4, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.

Previous 1 23