Mxgeneralio EUVD-2026-20111

Local attacker with high privileges on Moxa industrial x86 computers running the MxGeneralIo utility. Attacker must have elevated/administrative access to abuse exposed IOCTL methods for MSR and system memory read/write operations. Affects Windows 7, 10, and 11.

Real-world exploitation risk is substantially lower than the CVSS 7.0 base score suggests due to restrictive prerequisites. The CVSS vector indicates network attack vector (AV:N) but requires high privileges (PR:H), creating a practical contradiction-an attacker must already possess administrative or SYSTEM-level access on the target machine before exploiting this driver vulnerability. This positions the flaw as a privilege maintenance or lateral movement vector rather than initial access. The high availability impact (VA:H) reflects realistic BSoD potential on modern Windows platforms, making denial-of-service the most probable outcome. Privilege escalation to kernel level on Windows 7 presents higher severity but affects an end-of-life operating system with diminishing deployment in industrial environments. No CISA KEV listing indicates no confirmed active exploitation campaigns. No publicly available exploit code has been identified, reducing immediate weaponization risk. The SSVC framework would likely classify this as 'scheduled' priority: exploitation requires existing high privileges (not automatable from external position), technical impact limited to the vulnerable device without identified downstream effects, and vendor patches available. Organizations running Moxa industrial computers with legacy Windows 7 systems face elevated risk and should prioritize patching; Windows 10/11 deployments face primarily availability concerns manageable through standard patch cycles.

An attacker who has already compromised a Moxa industrial PC with administrative credentials (through phishing, credential theft, or insider threat) could deploy a custom exploit tool that interfaces with the exposed MxGeneralIo IOCTL handlers. On a Windows 7 system, the attacker invokes IOCTL commands to write specific values to CPU Model-Specific Registers or inject code into kernel memory regions, bypassing remaining security boundaries to escalate from Administrator to SYSTEM-level privileges with full kernel access, enabling rootkit installation or complete system control while evading detection mechanisms. On Windows 10/11 systems with stronger kernel protections, similar IOCTL abuse attempts to modify protected kernel memory structures trigger Kernel Patch Protection violations, immediately causing a system crash with Blue Screen of Death, resulting in operational disruption to industrial processes dependent on the affected computer. No publicly available exploit code exists, requiring attackers to develop custom tooling based on reverse engineering the MxGeneralIo driver, though the technical barrier is low for adversaries with existing high-privilege access and kernel programming expertise.