Temperature Monitor Utility
Monthly
Local privilege escalation in the BioStar Temperature Monitor Utility (1.2.1806.2200, all versions flagged by CPE) lets a low-privileged process on an affected Windows host write attacker-controlled data to an arbitrary physical address through the bundled BS_HWMIO64_W10.sys kernel driver, escalating to SYSTEM and gaining full control of the machine. According to the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local low-privilege code execution able to open the driver's device object and send the crafted IOCTL, with no user interaction and no non-default configuration once the signed driver is loaded. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and the disclosure states the exploit was released publicly), but there is no indication of confirmed active exploitation in the wild and no CISA KEV listing; the vendor was contacted and did not respond, so no vendor patch was identified at time of analysis.
Local privilege escalation in the BioStar Temperature Monitor Utility (1.2.1806.2200, all versions flagged by CPE) lets a low-privileged process on an affected Windows host write attacker-controlled data to an arbitrary physical address through the bundled BS_HWMIO64_W10.sys kernel driver, escalating to SYSTEM and gaining full control of the machine. According to the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local low-privilege code execution able to open the driver's device object and send the crafted IOCTL, with no user interaction and no non-default configuration once the signed driver is loaded. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and the disclosure states the exploit was released publicly), but there is no indication of confirmed active exploitation in the wild and no CISA KEV listing; the vendor was contacted and did not respond, so no vendor patch was identified at time of analysis.