Poweriso
Monthly
Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.
A memory corruption vulnerability exists in the VHD File Format parsing CXSPARSE record functionality of PowerISO PowerISO 8.3. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A memory corruption vulnerability exists in the DMG File Format Handler functionality of PowerISO 7.9. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability exists in the .ISO parsing functionality of PowerISO 6.8. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stack buffer overflow vulnerability exists in the ISO parsing functionality of Power Software Ltd PowerISO 6.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.
A memory corruption vulnerability exists in the VHD File Format parsing CXSPARSE record functionality of PowerISO PowerISO 8.3. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A memory corruption vulnerability exists in the DMG File Format Handler functionality of PowerISO 7.9. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free vulnerability exists in the .ISO parsing functionality of PowerISO 6.8. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A stack buffer overflow vulnerability exists in the ISO parsing functionality of Power Software Ltd PowerISO 6.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.