PT-2024-25162 · Wistron · Tbt Force Power Control

Driverhunter · Published 2024-05-22 · Updated 2024-08-22 · CVE-2024-33226

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

**Name of the Vulnerable Software and Affected Versions**

Wistron Corporation TBT Force Power Control version 1.0.0.0

**Description**

An issue in the component Access64.sys allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.

**Recommendations**

For version 1.0.0.0, consider restricting access to the Access64.sys component to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the vulnerable component to send crafted IOCTL requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-33226

Affected Products

Tbt Force Power Control

References · 6

• 🔥 https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33226 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-33226 · Security Note
• https://t.me/cvenotify/80764 · Telegram Post
• https://t.me/cvenotify/80719 · Telegram Post
• https://twitter.com/CVEnew/status/1793384183835857026 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1793372603853472053 · Twitter Post