PT-2022-26222 · Wfs · Heavenburnsred

Doranekosystems + 1 · Published 2022-12-20 · Updated 2025-03-26 · CVE-2022-42046

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WFS, Inc HeavenBurnsRed version 2020.3.15.7141260

Description The issue allows for local privilege escalation through specially crafted IOCTL requests to wfshbr64.sys and wfshbr32.sys drivers. This can enable an arbitrary user to gain elevated privileges. The estimated number of potentially affected devices and details about real-world incidents where this issue was exploited are not provided.

Recommendations For WFS, Inc HeavenBurnsRed version 2020.3.15.7141260, consider updating to a newer version that uses ObRegisterCallbacks instead of PPL to mitigate the risk of local privilege escalation. As a temporary workaround, consider restricting access to the wfshbr64.sys and wfshbr32.sys drivers until a patch is available. Avoid using the vulnerable IOCTL requests to the wfshbr64.sys and wfshbr32.sys drivers until the issue is resolved.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-42046

Affected Products

Heavenburnsred

References · 13

• 🔥 https://github.com/kkent030315/CVE-2022-42046 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-42046 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42046 · Vendor Advisory
• https://wfs.games/news/20221220_01.html · Vendor Advisory
• https://github.com/Ananthavijay/Mail-log-Manipulation · Note
• https://t.me/cybersecuritytechnologies/7421 · Telegram Post
• https://t.me/cvenotify/116363 · Telegram Post
• https://t.me/freedomf0x/18739 · Telegram Post
• https://t.me/cibsecurity/55035 · Telegram Post
• https://t.me/proxy_bar/1244 · Telegram Post
• https://twitter.com/kento932376/status/1752339169769312696 · Twitter Post
• https://t.me/p0x3k/1336 · Telegram Post
• https://t.me/ckure/12032 · Telegram Post