rootpwn

critical · CVSS v3 8.8 · CVSS v4 9.3 · EPSS 0.00127

CVE-2026-94142

CVE-2026-94142 exposes a write-what-where flaw in the BioStar Temperature Monitor Utility driver (BS_HWMIO64_W10.sys). The vulnerability all

Overview

CVE-2026-94142 exposes a write-what-where flaw in the BioStar Temperature Monitor Utility driver (BS_HWMIO64_W10.sys). The vulnerability allows a local attacker to manipulate the PhysicalAddress argument of the IOCTL handler, potentially leading to arbitrary memory writes. It is rated critical and has been publicly disclosed.

Description

A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argument PhysicalAddress leads to write-what-where condition. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

The flaw can compromise confidentiality by leaking sensitive data, integrity by corrupting system memory, and availability by causing crashes or instability. Local users with sufficient privileges can exploit the driver to gain elevated rights or execute arbitrary code. System administrators and any services running under the affected driver are at risk.

Remediation

Apply the vendor’s official patch or upgrade to a newer version of the BioStar Temperature Monitor Utility. If a patch is unavailable, disable the driver or restrict local access to the IOCTL interface via group policy or ACLs. Enable Windows Driver Signature Enforcement and monitor for anomalous driver activity.

Risk context

Severity is critical with CVSS v3 score 8.8 and v4 score 9.3. The EPSS score of 0.00127 indicates a low probability of exploitation, but the high impact warrants prompt mitigation.

Affected products

  • BioStar Temperature Monitor Utility 1.2.1806.2200

Scores

Severity
critical
CVSS v2
6.8
CVSS v3
8.8
CVSS v4
9.3
EPSS
0.00127

write-what-where local-privilege-escalation driver critical BioStar IOCTL

← All CVEs

Related CVEs

critical

CVE-2026-88854

The vulnerability is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension’s search endpoint. It allows attackers to execute arbitrary SQL queries and exfiltrate database contents without authentication. The flaw exists because the getVar() method is not properly sanitized.

View analysis

critical

CVE-2026-94146

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94301

CVE-2026-94301 exposes a proxy class resolution bypass in Apache MINA, allowing attackers to evade allow‑list checks and potentially execute arbitrary code. The flaw remains in the 2.0.x and 2.1.x maintenance branches even though it was fixed in 2.2.x. It can compromise confidentiality, integrity, and availability of Java applications that use these libraries.

View analysis

critical

CVE-2026-94379

The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically: - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked - the email OTP two-factor authentication step was skipped, defeating the second factor of authentication - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry. The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance. Version affected: <2.5.47

View analysis