PT-2022-9006 · Microsoft+1 · Windows+2

Kento Oki · Published 2022-09-14 · Updated 2025-08-08 · CVE-2020-36603

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Genshin Impact mhyprot2.sys version 1.0.0.0

Description The Genshin Impact mhyprot2.sys anti-cheat driver does not adequately restrict unprivileged function calls, allowing local, unprivileged users to execute arbitrary code with SYSTEM privileges on Microsoft Windows systems. The mhyprot2.sys driver must first be installed by a user with administrative privileges.

Recommendations For Genshin Impact mhyprot2.sys version 1.0.0.0, consider uninstalling or disabling the driver to prevent exploitation until a patch is available. As a temporary workaround, restrict access to the system to minimize the risk of local, unprivileged users executing arbitrary code with SYSTEM privileges.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-36603

Affected Products

Genshin Impact

Windows

Mhyprot2.Sys

References · 11

• 🔥 https://trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html · Exploit
• 🔥 https://vice.com/en/article/y3p35w/hackers-are-using-anti-cheat-in-genshin-impact-to-ransom-victims · Exploit
• 🔥 https://web.archive.org/web/20211204031301/https://godeye.club/2021/05/20/001-disclosure-mhyprot.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36603 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36603 · Vendor Advisory
• https://github.com/kagurazakasanae/Mhyprot2DrvControl · Note
• https://github.com/kkent030315/evil-mhyprot-cli · Note
• https://t.me/cibsecurity/49806 · Telegram Post
• https://twitter.com/6E657275/status/1931303103237632440 · Twitter Post
• https://twitter.com/qe201020335/status/1953940221675921545 · Twitter Post
• https://t.me/cvenotify/124601 · Telegram Post