EUVD-2026-97368
GHSA-wgpj-m7xc-f5q8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged access
-
DeliveryOpen handle to LWBilling64 device
-
ExploitSend IOCTL with attacker-chosen PID
-
ExecutionDriver terminates targeted process
-
ImpactDisable security tools or disrupt services
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Exposed IOCTL with insufficient ACL
|
| Exploitation Conditions | Requires the Yungengxin Cloud Billing 2024.11.28.11 product to be installed with its LWBilling64.sys kernel driver loaded, and the attacker must already have local low-privileged (PR:L) authenticated access to the host; no user interaction (UI:N) and no elevated privileges are needed beyond that. The exposed IOCTL handler for process termination accepts a caller-supplied Pid without adequate access-control checks, so no special non-default configuration is required once the vulnerable driver is present. Limiting factors: exploitation is strictly local (no remote/network path), impact is confined to terminating processes (availability/integrity, not data disclosure), and the narrow deployment footprint of this software greatly constrains real-world reach. |
| Impact | This is a low-real-risk issue despite being a kernel driver flaw. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the vendor-assigned score of 1.9 agree that exploitation requires local access by an already-authenticated low-privileged user, with impact limited to VI:L/VA:L (partial integrity/availability) and no confidentiality impact (VC:N). The signal E:P confirms a published proof-of-concept exploit exists, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the PoC is a distinct signal from in-the-wild use. The core weakness (CWE-782, exposed IOCTL with insufficient access control in LWBilling64.sys) lets a low-privileged local user terminate arbitrary processes by manipulating the Pid argument, which is primarily a denial-of-service / security-tool-kill primitive rather than a confidentiality breach. Because the vendor was contacted but never responded, no official fix is confirmed. Net: a real but low-priority flaw - relevant mainly on hosts where the affected billing software is installed and where defenders care about local users disabling endpoint protection. |
| Exploit ScenarioDerived | A low-privileged local user (or malware already running with limited rights) on a machine where Yungengxin Cloud Billing is installed opens a handle to the LWBilling64.sys driver and sends a crafted IOCTL specifying an arbitrary target PID. The driver, lacking proper caller access-control checks, terminates that process - allowing the attacker to kill antivirus/EDR or other protective processes. A public proof-of-concept exploit has been published, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Local process termination in Yungengxin Cloud Billing 2024.11.28.11 allows any authenticated local user who can reach the bundled LWBilling64.sys kernel driver to kill arbitrary processes running on the host, because the IOCTL handler at sub_14000443C acts on a caller-supplied Pid without adequate access control. Exploitation requires only local low-privileged access (CVSS 3.1 AV:L/AC:L/PR:L/UI:N), with no user interaction and no elevation beyond that, and the impact is confined to integrity and availability - no data disclosure and no remote path exist. Publicly available exploit code has been published and may be used, but the issue is not in CISA KEV, the scored severity is low (CVSS 4.0 base 1.9, E:P), and the software's narrow deployment footprint limits real-world reach; the vendor was contacted prior to disclosure and did not respond.
RemediationAI
No vendor-released patch identified at time of analysis: Yungengxin was contacted early about the flaw and did not respond, and no fixed build or advisory is referenced in any source, so remediation must be compensating. The most direct control is to remove or disable the LWBilling64.sys kernel driver on any host where the billing product's driver-backed features are not actively needed - for example by stopping and disabling the associated kernel service and renaming or deleting the driver binary - with the acknowledged trade-off that the Cloud Billing software's driver-dependent functionality will stop working or fail to start. Where the product must remain operational, enforce a Windows Defender Application Control (WDAC) or similar code-integrity policy that blocks loading of this driver by hash, and check whether its hash appears on Microsoft's vulnerable-driver blocklist so that HVCI can refuse it automatically; both measures degrade gracefully but require policy maintenance and, if the hash is not listed, custom rule authoring. Because exploitation requires only PR:L local access, do not rely on least-privilege hardening of the billing service account - restrict interactive logon on hosts running the product to trusted administrators, treat any shared or multi-user terminal with this software installed as untrusted, and monitor for anomalous process terminations (unexpected loss of security agents, backup jobs, or monitoring services) which are the observable signature of this IOCTL being abused. No patch version should be assumed; re-check the VulDB references (https://vuldb.com/vuln/416681) for updated vendor information before lifting these compensating controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause maps to CWE-782 (Exposed IOCTL with Insufficient Access Control) in a Windows kernel-mode driver, LWBilling64.sys, shipped with Yungengxin Cloud Billing 2024.11.28.11. The driver exposes an IRP_MJ_DEVICE_CONTROL dispatch path whose handler, identified as sub_14000443C (an x64 image-base address, indicating a 64-bit PE driver), implements a process-termination operation that takes a caller-supplied Pid argument and forwards it toward process-handle/termination routines without verifying that the requesting process holds the privileges normally required for terminating other processes. Because the device object and its IOCTL contract are reachable from user mode with only low privileges, a local caller can supply an arbitrary PID and cause the driver to terminate that process - the classic pattern of a privileged kernel primitive that the access-control layer fails to gate. Consistent with this, the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L: strictly local, low complexity, authenticated low-privileged actor, no user interaction, no scope change, no confidentiality impact, and low integrity and availability impact. Unlike typical kernel-driver flaws that enable arbitrary read/write or token theft, this handler is functionally narrow (process termination only), which caps impact at disruption of process availability and any integrity consequences of forcibly killed applications; both the CVSS 4.0 vector supplied by the reporter (VC:N/VI:L/VA:L) and our 3.1 assessment agree on this limited blast radius.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Local authenticated low-privileged user sends an IOCTL with no special conditions (AV:L/AC:L/PR:L/UI:N); killing arbitrary processes yields partial integrity/availability impact and no confidentiality loss (C:N).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access control. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB