PowerISO scdvm.sys Local Privilege Escalation via Arbitrary Registry Write/Delete

Vulnerability Overview A local privilege escalation vulnerability exists in the signed kernel driver of PowerISO 9.3.0.0. This vulnerability allows an attacker to achieve local privilege escalation through arbitrary registry write or delete operations. Impact Scope Affected Product: PowerISO Tested Version: 9.3.0 x64 Installation Path: Driver Path: Driver Version: 6.9.0.0 Driver SHA-256: Remediation No specific remediation is currently provided on the page. Users are advised to monitor official PowerISO updates or patches to address this vulnerability. POC Code No specific POC code or exploit code is provided on the page. Additional Information Vulnerability Type: Local Privilege Escalation Vulnerability Description: The signed kernel driver installed with PowerISO 9.3 creates a user-visible CD device link upon loading. Two registry-related IOCTLs are accessible to standard users: - : Writes or deletes registry values selected by the caller via . - : Opens or deletes registry keys selected by the caller. The driver performs these operations without enforcing the caller's normal privileges. During validation, while standard users cannot directly write to or delete protected HKLM objects, they can write to protected HKLM values and delete protected HKLM keys. An unprivileged user can leverage a combination of arbitrary registry write and delete primitives to achieve local privilege escalation in specific scenarios. This includes reliably hijacking COM server registry entries with attacker-controlled DLL paths by replacing the service or values, or executing SYSTEM-level code via LSA policies and automatic key triggers. This approach offers higher reliability and a lower detection surface compared to using delete primitives alone.

Goal Reached Thanks to every supporter — we hit 100%!

PowerISO scdvm.sys Local Privilege Escalation via Arbitrary Registry Write/Delete