EUVD-2026-83835
GHSA-8fx2-frcj-2gw4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local IOCTL reachable by a low-priv user (AV:L/PR:L/AC:L, no UI); kernel write-what-where yields full SYSTEM compromise (C/I/A:H) but stays on the same host, so S:U.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
7DescriptionCVE.org
A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argument PhysicalAddress leads to write-what-where condition. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in the BioStar Temperature Monitor Utility (1.2.1806.2200, all versions flagged by CPE) lets a low-privileged process on an affected Windows host write attacker-controlled data to an arbitrary physical address through the bundled BS_HWMIO64_W10.sys kernel driver, escalating to SYSTEM and gaining full control of the machine. According to the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local low-privilege code execution able to open the driver's device object and send the crafted IOCTL, with no user interaction and no non-default configuration once the signed driver is loaded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a Windows host on which the BioStar Temperature Monitor Utility 1.2.1806.2200 (and its BS_HWMIO64_W10.sys driver) is installed and loaded; the attacker must already have low-privilege code execution (PR:L) able to open the driver's device object and issue the IOCTL handled by sub_1105C with a controlled PhysicalAddress. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine local privilege-escalation priority, not a high-CVSS-but-low-risk paper cut. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis: BioStar was contacted early about the issue and did not respond, so there is no fixed version to upgrade to and no vendor advisory beyond the VulDB records (https://vuldb.com/vuln/408057, https://vuldb.com/cve/CVE-2026-94142). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows endpoints for BioStar Temperature Monitor Utility version 1.2.1806.2200 and the BS_HWMIO64_W10.sys driver, confirm whether the driver is loaded, and remove or disable the utility and driver on non-essential systems; where removal is not immediately possible, use Windows Defender Application Control or AppLocker to block BS_HWMIO64_W10.sys, restrict local interactive logon and local administrator rights, and enable EDR alerting for driver load and suspicious IOCTL activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same weakness CWE-123 – Write-what-where Condition
View allShare
External POC / Exploit Code
Leaving vuln.today