Shunwang shzh CVE-2026-94137

Requires local access to a Windows host running Hangzhou Shunwang Technology shzh 10.7.2.693 with the shdrv_x64.sys kernel driver loaded, plus the ability to open the driver's device object and issue an IRP_MJ_DEVICE_CONTROL IOCTL (PR:L - a local authenticated/low-privileged user). Exploitation is limited by: no remote vector (AV:L, attacker must already be on the machine), and the affected product being specialized internet-café management software rather than general-purpose enterprise software. No user interaction and no special non-default configuration is needed beyond the software being installed and its driver active; the manipulated PID argument alone triggers the fault.

This is a genuinely low-to-moderate real-world risk despite being a kernel-mode driver flaw. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms local, low-privileged, no-interaction exploitation with pure availability impact (VA:L) - an authenticated local user crashing a component via a malformed PID argument to an IOCTL. SSVC/E:P signals that proof-of-concept exploit code exists (POC=YES) but there is NO CISA KEV listing and NO EPSS score supplied, so this is 'publicly available exploit code exists' - not active exploitation. The impact is confined to denial of service: no confidentiality or integrity loss (VC:N/VI:N), so it is not a privilege-escalation or RCE primitive as described. One conflict worth noting: the vendor scored availability as VA:L (partial), but a fault inside a Windows kernel driver (shdrv_x64.sys) reached through IRP_MJ_DEVICE_CONTROL typically bugchecks the entire host (full BSOD), which would justify VA:H/A:H - verify whether the crash is process-scoped or system-wide. Because exploitation requires an existing local low-privileged foothold on a machine running this specific internet-café management driver, this is a low-priority local DoS, not a widespread remote threat.

A local low-privileged user (or malware already resident) on a Windows host running Shunwang's shzh software opens a handle to the vulnerable device and issues a crafted IRP_MJ_DEVICE_CONTROL IOCTL with a manipulated PID argument to sub_180004AC0 in shdrv_x64.sys, triggering improper resource handling and crashing the driver/host. Public proof-of-concept exploit code is referenced (VulDB, E:P), and a driver sample hash is catalogued on VirusTotal. The local-only, low-complexity vector makes this trivially reproducible once an attacker has any interactive or code-execution foothold.