| शीर्षक | PowerISO PowerISO 9.3.0.0 Kernel Driver 6.9.0.0 Local Privilege Escalation |
|---|
| विवरण | PowerISO 9.3 installs the signed kernel driver scdemu.sys. When loaded, the driver creates user-visible virtual CD device links such as \\.\SCDEmuDev0. Two registry helper IOCTLs are reachable from a standard user:
0x80002018: writes or deletes a caller-selected registry value through RtlWriteRegistryValue.
0x8000201C: opens and deletes a caller-selected empty registry key.
The driver performs these operations from kernel context without enforcing the caller's normal registry permissions. In the validation below, a standard user could not directly write or delete protected HKLM objects, but could write a protected HKLM value and delete a protected empty HKLM key through \\.\SCDEmuDev0.
An unprivileged user can exploit combined arbitrary registry write and deletion primitives to achieve local privilege escalation under certain circumstances, such as atomically replacing service ImagePath or FailureCommand values, deterministically hijacking COM server registrations with attacker-controlled DLL paths, or tampering with LSA policy and autorun keys to trigger SYSTEM code execution — offering higher reliability and reduced detection surface compared to deletion-only primitives. |
|---|
| स्रोत | ⚠️ https://winslow1984.com/books/cve-collection/page/poweriso-9300-kernel-driver-6900-local-privilege-escalation-via-arbitrary-registry-write-or-deletion |
|---|
| उपयोगकर्ता | winslow1984 (UID 79140) |
|---|
| सबमिशन | 20/06/2026 06:38 PM (2 महीनों पहले) |
|---|
| संयम | 06/08/2026 09:56 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 386707 [Power Sofware PowerISO 9.3.0.0 Kernel Driver scdemu.sys अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|