Shzh
Monthly
Local denial of service in Hangzhou Shunwang Technology's shzh 10.7.2.693 (internet-café management software) allows a local, low-privileged authenticated user to crash the host by sending a crafted IRP_MJ_DEVICE_CONTROL request with a manipulated PID argument to the shdrv_x64.sys kernel-mode driver, which mishandles the value and fails to release resources cleanly. The provider records CVSS 4.0 base 4.8 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/E:P), while our independent assessment maps the flaw to CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. a local user can fully disrupt availability of the host. No CISA KEV entry or EPSS data was provided, but the vector's exploit maturity value (E:P) indicates publicly available proof-of-concept exploit code exists; because the attack requires an attacker to already have local access to a machine running this specialized software, real-world risk is low-to-moderate.
Local denial of service in Hangzhou Shunwang Technology's shzh 10.7.2.693 (internet-café management software) allows a local, low-privileged authenticated user to crash the host by sending a crafted IRP_MJ_DEVICE_CONTROL request with a manipulated PID argument to the shdrv_x64.sys kernel-mode driver, which mishandles the value and fails to release resources cleanly. The provider records CVSS 4.0 base 4.8 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/E:P), while our independent assessment maps the flaw to CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. a local user can fully disrupt availability of the host. No CISA KEV entry or EPSS data was provided, but the vector's exploit maturity value (E:P) indicates publicly available proof-of-concept exploit code exists; because the attack requires an attacker to already have local access to a machine running this specialized software, real-world risk is low-to-moderate.