CVE-2020-9756 Missing authorization in n/a
A local attacker can exploit insufficient access control in the Patriot Viper RGB driver to read/write IO ports and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9756?
CVE-2020-9756 is a high-severity missing authorization vulnerability in n/a, published on 6 Mar 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Patriot Viper RGB Driver 1.1 and prior exposes IOCTL and allows insufficient access control. The IOCTL Codes 0x80102050 and 0x80102054 allows a local user with low privileges to read/write 1/2/4 bytes from or to an IO port. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
Which versions are affected by CVE-2020-9756?
It affects 1 product.
Products include Patriotmemory Viper Rgb Firmware.
How do I fix CVE-2020-9756?
No fix has been published for CVE-2020-9756 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-9756 being exploited?
There is no known exploitation of CVE-2020-9756 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-59f5-p3f5-g79r.