PT-2024-25162 · Wistron · Tbt Force Power Control

Driverhunter · Published 2024-05-22 · Updated 2024-08-22 · CVE-2024-33226

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Wistron Corporation TBT Force Power Control version 1.0.0.0

Description An issue in the component Access64.sys allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.

Recommendations For version 1.0.0.0, consider restricting access to the Access64.sys component to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the vulnerable component to send crafted IOCTL requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-33226

Affected Products

Tbt Force Power Control

References · 6

• 🔥 https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33226 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-33226 · Security Note
• https://t.me/cvenotify/80764 · Telegram Post
• https://twitter.com/CVEnew/status/1793384183835857026 · Twitter Post
• https://t.me/cvenotify/80719 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1793372603853472053 · Twitter Post