| Название | PowerISO PowerISO 9.3.0.0 Kernel Driver 6.9.0.0 Local Privilege Escalation |
|---|
| Описание | PowerISO 9.3 installs the signed kernel driver scdemu.sys. When loaded, the driver creates user-visible virtual CD device links such as \\.\SCDEmuDev0. Two registry helper IOCTLs are reachable from a standard user:
0x80002018: writes or deletes a caller-selected registry value through RtlWriteRegistryValue.
0x8000201C: opens and deletes a caller-selected empty registry key.
The driver performs these operations from kernel context without enforcing the caller's normal registry permissions. In the validation below, a standard user could not directly write or delete protected HKLM objects, but could write a protected HKLM value and delete a protected empty HKLM key through \\.\SCDEmuDev0.
An unprivileged user can exploit combined arbitrary registry write and deletion primitives to achieve local privilege escalation under certain circumstances, such as atomically replacing service ImagePath or FailureCommand values, deterministically hijacking COM server registrations with attacker-controlled DLL paths, or tampering with LSA policy and autorun keys to trigger SYSTEM code execution — offering higher reliability and reduced detection surface compared to deletion-only primitives. |
|---|
| Источник | ⚠️ https://winslow1984.com/books/cve-collection/page/poweriso-9300-kernel-driver-6900-local-privilege-escalation-via-arbitrary-registry-write-or-deletion |
|---|
| Пользователь | winslow1984 (UID 79140) |
|---|
| Представление | 20.06.2026 18:38 (2 месяцы назад) |
|---|
| Модерация | 06.08.2026 21:56 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 386707 [Power Sofware PowerISO 9.3.0.0 Kernel Driver scdemu.sys эскалация привилегий] |
|---|
| Баллы | 20 |
|---|