CWE-782 Exposed IOCTL with Insufficient Access Control
variantThe product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (50)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-21551US | high7.8OT critical | KEV | ||
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local aut… | ||||
| CVE-2018-19321US | high7.8OT critical | KEV | ||
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose… | ||||
| CVE-2024-4196US | critical9.8 | — | ||
An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Contr… | ||||
| CVE-2021-21789US | high8.8 | — | ||
A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0e0, the firs… | ||||
| CVE-2021-21788US | high8.8 | — | ||
A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0dc, the firs… | ||||
| CVE-2021-21787US | high8.8 | — | ||
A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0d8, the firs… | ||||
| CVE-2026-80116US | high7.8 | — | ||
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo6… | ||||
| CVE-2021-25695US | high7.8 | — | ||
The USB vHub in the Teradici PCOIP Software Agent prior to version 21.07.0 would accept commands from any program, which may allow an attacker to elevate privileges by changing the… | ||||
| CVE-2021-21786US | high7.8 | — | ||
A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead… | ||||
| CVE-2026-80117US | high7.1 | — | ||
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo6… | ||||
| CVE-2026-80113US | high7.1 | — | ||
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo6… | ||||
| CVE-2026-80115US | medium6.1 | — | ||
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation and denial-of-service vuln… | ||||
| CVE-2021-21792US | medium5.5 | — | ||
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O req… | ||||
| CVE-2021-21791US | medium5.5 | — | ||
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O req… | ||||
| CVE-2021-21790US | medium5.5 | — | ||
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O req… | ||||
| CVE-2021-21785US | medium5.5 | — | ||
An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can l… | ||||
| CVE-2026-108889US | medium4.4 | — | ||
A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the component IOCTL… | ||||
| CVE-2025-27535US | medium4.1 | — | ||
Exposed ioctl with insufficient access control in the firmware for some Intel(R) Ethernet Connection E825-C. before version NVM ver. 3.84 within Ring 0: Bare Metal OS may allow a d… | ||||
| CVE-2025-7771US | — | Exploit | ||
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure imple… | ||||
| CVE-2026-38764US | — | Exploit | ||
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan