CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-21788
https://notcve.org/view.php?id=CVE-2021-21788
A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0dc, the first dword passed in the input buffer is the device port to write to and the word at offset 4 is the value to write via the OUT instruction. The OUT instruction can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users. A local attacker can send a malicious IRP to trigger this vulnerability. Se presenta una vulnerabilidad de escalada de privilegios en la forma en que el controlador IOBit Advanced SystemCare Ultimate versión 14.2.0.220, maneja las peticiones de escritura de I/O con privilegios. • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1254 • CWE-782: Exposed IOCTL with Insufficient Access Control •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-21787
https://notcve.org/view.php?id=CVE-2021-21787
A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0d8, the first dword passed in the input buffer is the device port to write to and the byte at offset 4 is the value to write via the OUT instruction. The OUT instruction can write one byte to the given I/O device port, potentially leading to escalated privileges of unprivileged users. Se presenta una vulnerabilidad de escalada de privilegios en la forma en que el controlador IOBit Advanced SystemCare Ultimate versión 14.2.0.220, maneja las peticiones de escritura de I/O con Privilegios. Durante IOCTL 0x9c40a0d8, el primer dword pasado en el buffer de entrada es el puerto del dispositivo para escribir y el byte en el offset 4 es el valor para escribir por medio de la instrucción OUT. • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1254 • CWE-782: Exposed IOCTL with Insufficient Access Control •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-10234
https://notcve.org/view.php?id=CVE-2020-10234
The AscRegistryFilter.sys kernel driver in IObit Advanced SystemCare 13.2 allows an unprivileged user to send an IOCTL to the device driver. If the user provides a NULL entry for the dwIoControlCode parameter, a kernel panic (aka BSOD) follows. The IOCTL codes can be found in the dispatch function: 0x8001E000, 0x8001E004, 0x8001E008, 0x8001E00C, 0x8001E010, 0x8001E014, 0x8001E020, 0x8001E024, 0x8001E040, 0x8001E044, and 0x8001E048. \DosDevices\AscRegistryFilter and \Device\AscRegistryFilter are affected. El controlador del kernel AscRegistryFilter.sys en IObit Advanced SystemCare versión 13.2, permite a un usuario no privilegiado enviar un IOCTL hacia el controlador del dispositivo. • https://github.com/FULLSHADE/Kernel-exploits https://github.com/FULLSHADE/Kernel-exploits/tree/master/AscRegistryFilter.sys https://www.iobit.com/en/advancedsystemcarefree.php •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23864
https://notcve.org/view.php?id=CVE-2020-23864
An issue exits in IOBit Malware Fighter version 8.0.2.547. Local escalation of privileges is possible by dropping a malicious DLL file into the WindowsApps folder. Se presenta un problema en IOBit Malware Fighter versión 8.0.2.547. La escalada local de privilegios es posible al colocar un archivo DLL malicioso en la carpeta WindowsApps • http://daniels-it-blog.blogspot.com/2020/07/iobit-malware-fighter-arbitrary-code.html •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-15401
https://notcve.org/view.php?id=CVE-2020-15401
IOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by manipulating malicious flagged file locations with an NTFS junction and an Object Manager symbolic link. IOBit Malware Fighter Pro versión 8.0.2.547, permite a usuarios locales alcanzar privilegios para una eliminación de archivos al manipular ubicaciones de archivos con marcas maliciosas con una unión NTFS y un enlace simbólico de Object Manager • http://daniels-it-blog.blogspot.com/2020/06/when-your-anti-virus-turns-against-you.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •