CWE-782
AllowedExposed IOCTL with Insufficient Access Control
Abstraction: Variant · Status: Draft
The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
66 vulnerabilities reference this CWE, most recent first.
GHSA-Q74F-J88C-7G46
Vulnerability from github – Published: 2026-05-08 03:30 – Updated: 2026-05-08 03:30An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms and obtain restricted touchpad information or render the touchpad unusable via crafted IOCTL requests.Refer to the ' Security Update for ASUS Precision Touchpad ' section on the ASUS Security Advisory for more information.
{
"affected": [],
"aliases": [
"CVE-2026-6737"
],
"database_specific": {
"cwe_ids": [
"CWE-782"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-08T03:16:24Z",
"severity": "LOW"
},
"details": "An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms and obtain restricted touchpad information or render the touchpad unusable\u00a0via crafted IOCTL requests.Refer to the \u0027\nSecurity Update for ASUS Precision Touchpad\u00a0\u0027 section on the ASUS Security Advisory for more information.",
"id": "GHSA-q74f-j88c-7g46",
"modified": "2026-05-08T03:30:24Z",
"published": "2026-05-08T03:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6737"
},
{
"type": "WEB",
"url": "https://www.asus.com/security-advisory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VGFG-VXW7-9MC6
Vulnerability from github – Published: 2026-09-08 03:31 – Updated: 2026-09-08 03:31Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
{
"affected": [],
"aliases": [
"CVE-2026-75809"
],
"database_specific": {
"cwe_ids": [
"CWE-782"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T03:17:18Z",
"severity": "MODERATE"
},
"details": "Exposed IOCTL with insufficient access control in ASUS\u00a0Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the \u0027\nSecurity Update for Armoury Crate App\u00a0\u0027 section on the ASUS Security Advisory for more information.",
"id": "GHSA-vgfg-vxw7-9mc6",
"modified": "2026-09-08T03:31:14Z",
"published": "2026-09-08T03:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75809"
},
{
"type": "WEB",
"url": "https://www.asus.com/security-advisory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X42P-Q354-PX3C
Vulnerability from github – Published: 2026-06-01 18:31 – Updated: 2026-06-01 21:30Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit this vulnerability to perform sensitive and privileged operations on the target system.
{
"affected": [],
"aliases": [
"CVE-2026-8501"
],
"database_specific": {
"cwe_ids": [
"CWE-782"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-01T17:17:35Z",
"severity": "HIGH"
},
"details": "Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit this vulnerability to perform sensitive and privileged operations on the target system.",
"id": "GHSA-x42p-q354-px3c",
"modified": "2026-06-01T21:30:41Z",
"published": "2026-06-01T18:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8501"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/158530"
},
{
"type": "WEB",
"url": "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules"
},
{
"type": "WEB",
"url": "https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/158530"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XCWR-X5FM-7JMR
Vulnerability from github – Published: 2025-08-01 15:34 – Updated: 2025-08-01 15:34Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023.
{
"affected": [],
"aliases": [
"CVE-2023-44976"
],
"database_specific": {
"cwe_ids": [
"CWE-782"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-01T14:15:34Z",
"severity": "LOW"
},
"details": "Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in the wild in October 2023.",
"id": "GHSA-xcwr-x5fm-7jmr",
"modified": "2025-08-01T15:34:18Z",
"published": "2025-08-01T15:34:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44976"
},
{
"type": "WEB",
"url": "https://github.com/keowu/BadRentdrv2"
},
{
"type": "WEB",
"url": "https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XCXV-MC83-GMW5
Vulnerability from github – Published: 2025-03-17 18:31 – Updated: 2025-03-19 21:30An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.
{
"affected": [],
"aliases": [
"CVE-2025-26125"
],
"database_specific": {
"cwe_ids": [
"CWE-782"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-17T18:15:21Z",
"severity": "MODERATE"
},
"details": "An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.",
"id": "GHSA-xcxv-mc83-gmw5",
"modified": "2025-03-19T21:30:49Z",
"published": "2025-03-17T18:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26125"
},
{
"type": "WEB",
"url": "https://github.com/ZeroMemoryEx/CVE-2025-26125"
},
{
"type": "WEB",
"url": "https://github.com/ZeroMemoryEx/IObit-EoP"
},
{
"type": "WEB",
"url": "https://x.com/zeromemoryex/status/1876878269200449819"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XW54-98C9-3F6V
Vulnerability from github – Published: 2026-09-04 21:31 – Updated: 2026-09-04 21:31PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the physical address parameter in an exposed IOCTL handler. Attackers can obtain a device handle and supply an arbitrary 64-bit physical address with a bit index to invoke MmMapIoSpace and clear bits in kernel code pages or page table entries, enabling local privilege escalation or system compromise.
{
"affected": [],
"aliases": [
"CVE-2026-80113"
],
"database_specific": {
"cwe_ids": [
"CWE-782"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T19:17:27Z",
"severity": "MODERATE"
},
"details": "PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the physical address parameter in an exposed IOCTL handler. Attackers can obtain a device handle and supply an arbitrary 64-bit physical address with a bit index to invoke MmMapIoSpace and clear bits in kernel code pages or page table entries, enabling local privilege escalation or system compromise.",
"id": "GHSA-xw54-98c9-3f6v",
"modified": "2026-09-04T21:31:50Z",
"published": "2026-09-04T21:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80113"
},
{
"type": "WEB",
"url": "https://dkom.dev/posts/directio64-disclosure"
},
{
"type": "WEB",
"url": "https://github.com/floppywiggler/directio64-disclosure"
},
{
"type": "WEB",
"url": "https://www.osforensics.com/whats-new.html"
},
{
"type": "WEB",
"url": "https://www.passmark.com/products/burnintest/history.php"
},
{
"type": "WEB",
"url": "https://www.passmark.com/products/performancetest/history.php"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/passmark-performancetest-burnintest-and-osforensics-arbitrary-bit-clear-via-directio64-sys-ioctl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
In Windows environments, use proper access control for the associated device or device namespace. See References.
No CAPEC attack patterns related to this CWE.