Skip to content
BackEsc
Sign in

CWE-782 · weakness in Access Control

Exposed IOCTL with Insufficient Access Control

51 CVEs · 1 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1

Every one of the 51 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local au…CVE-2021-21551Dell · CVSS 8.8 · 80% likely

    Dell

  2. Code Execution / Escalation of Privileges in ThrottleStopCVE-2025-7771TechPowerUp · CVSS 8.7 · 6.8% likely
  3. An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the ml…CVE-2024-32370Hsclabs · CVSS 9.8 · 1.0% likely
  4. An issue discovered in the DeviceIoControl component in ASUS Fan_Xpert before v.10013 allows an attacker to execute arbitrary code via crafted IOCTL requests.CVE-2024-30804CVSS 9.8 · 0.8% likely
  5. An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, execute arbitrary code, o…CVE-2024-39251CVSS 10 · 0.7% likely
  6. An issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOC…CVE-2024-33220Asus · CVSS 8.8 · 0.7% likely

    ASUS

  7. The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89F5…CVE-2026-36355CVSS 7.7 · 0.7% likely
  8. QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is ins…CVE-2026-84408QualitySoft Corporation · CVSS 8.7 · 0.6% likely

    QualitySoft Corporation

  9. Avaya IP Office Web Control RCE VulnerabilityCVE-2024-4196Avaya · CVSS 10 · 0.6% likely

    Avaya

  10. NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the GPU vBIOS that may allow a malicious actor with tenant level GPU access to write to an unsupported registry causing a b…CVE-2024-0141NVIDIA · CVSS 6.8 · 0.5% likely

    NVIDIA

  11. An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.CVE-2025-26125CVSS 7.3 · 0.5% likely
  12. A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenovo consumer notebooks that could allow…CVE-2025-8061Lenovo · CVSS 7 · 0.4% likely

    Lenovo

  13. An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O re…CVE-2021-21792IObit · CVSS 6.5 · 0.3% likely
  14. A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0d8, the fir…CVE-2021-21787Iobit · CVSS 8.8 · 0.3% likely
  15. An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O re…CVE-2021-21791IOBit · CVSS 6.5 · 0.3% likely
  16. An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O re…CVE-2021-21790IOBit · CVSS 6.5 · 0.3% likely
  17. An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can…CVE-2021-21785IOBit · CVSS 6.5 · 0.3% likely
  18. A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0e0, the fir…CVE-2021-21789Iobit · CVSS 8.8 · 0.3% likely
  19. A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write requests. During IOCTL 0x9c40a0dc, the fir…CVE-2021-21788Iobit · CVSS 8.8 · 0.3% likely
  20. An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGe…CVE-2026-4483Moxa · CVSS 7 · 0.3% likely

    Moxa

  21. Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E01…CVE-2023-44976Hangzhou Shunwang · CVSS 3.2 · 0.3% likely
  22. A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lea…CVE-2021-21786Iobit · CVSS 8.8 · 0.3% likely
  23. The USB vHub in the Teradici PCOIP Software Agent prior to version 21.07.0 would accept commands from any program, which may allow an attacker to elevate privileges by changing th…CVE-2021-25695- PCoIP Agent for Windows · 0.3% likely
  24. An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary code via sending cra…CVE-2024-33219Asus · CVSS 7.8 · 0.3% likely

    ASUS

  25. An issue in the component AsUpIO64.sys of ASUSTeK Computer Inc ASUS USB 3.0 Boost Storage Driver 5.30.20.0 allows attackers to escalate privileges and execute arbitrary code via s…CVE-2024-33218CVSS 7.8 · 0.2% likely
  26. An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execute arbitrary code via sending crafted I…CVE-2024-33222CVSS 8.4 · 0.2% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in