CVE-2024-33226 | An issue in the component Access64.sys of Wistron Corporatio… | CVSS 9.9 CRITICAL

Description

An issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.

Metadata

CVE ID: CVE-2024-33226
State: PUBLISHED
Assigner: mitre
Reserved: 2024-04-23 00:00 UTC
Published: 2024-05-22 15:17 UTC
Last updated: 2025-02-13 15:52 UTC
Primary CWE: CWE-269
CWE-269 Improper Privilege Management
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-269	adp	CWE-269 Improper Privilege Management

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References (1)

https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33226