CVE-2026-14961

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14961", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-07-07T14:26:02.918Z", "datePublished": "2026-07-15T17:09:52.285Z", "dateUpdated": "2026-07-15T19:31:32.591Z"}, "containers": {"cna": {"title": "CVE-2026-14961", "descriptions": [{"lang": "en", "value": "Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\\\.\\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to `NT AUTHORITY\\SYSTEM`, security product bypass, credential theft, or complete system compromise."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Pegatron Corp.", "product": "Tdelo64.sys", "versions": [{"status": "affected", "version": "02-17-2025", "lessThanOrEqual": "02-17-2025", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-284 Improper Access Control"}]}, {"descriptions": [{"lang": "en", "description": "CWE-781Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/529388"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-14961"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-15T17:09:52.285Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T19:30:44.030568Z", "id": "CVE-2026-14961", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T19:31:32.591Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14961", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-07-07T14:26:02.918Z", "datePublished": "2026-07-15T17:09:52.285Z", "dateUpdated": "2026-07-15T19:31:32.591Z"}, "containers": {"cna": {"title": "CVE-2026-14961", "descriptions": [{"lang": "en", "value": "Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\\\.\\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to `NT AUTHORITY\\SYSTEM`, security product bypass, credential theft, or complete system compromise."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Pegatron Corp.", "product": "Tdelo64.sys", "versions": [{"status": "affected", "version": "02-17-2025", "lessThanOrEqual": "02-17-2025", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-284 Improper Access Control"}]}, {"descriptions": [{"lang": "en", "description": "CWE-781Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/529388"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-14961"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-15T17:09:52.285Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-14961", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T19:30:44.030568Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T19:31:26.319Z"}}]}}

{"affected": [{"affectedData": [{"product": "Tdelo64.sys", "vendor": "Pegatron Corp.", "versions": [{"lessThanOrEqual": "02-17-2025", "status": "affected", "version": "02-17-2025", "versionType": "custom"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\\\.\\TdeIo`, that fails to properly restrict access to sensitive IOCTL functionality. The driver's IOCTL dispatcher does not validate caller privileges or verify user-supplied kernel memory addresses before performing memory operations. By sending crafted requests to IOCTL, a local attacker can achieve arbitrary kernel memory read and write operations, leading to privilege escalation to `NT AUTHORITY\\SYSTEM`, security product bypass, credential theft, or complete system compromise."}, {"lang": "es", "value": "Pegatron \u2019Tdelo64.sys\u2019 expone una interfaz de dispositivo privilegiada, \u2019\\\\.\\TdeIo\u2019, que no restringe adecuadamente el acceso a la funcionalidad IOCTL sensible. El despachador IOCTL del controlador no valida los privilegios del llamador ni verifica las direcciones de memoria del kernel proporcionadas por el usuario antes de realizar operaciones de memoria. Al enviar solicitudes manipuladas a IOCTL, un atacante local puede lograr operaciones arbitrarias de lectura y escritura en la memoria del kernel, lo que lleva a la escalada de privilegios a \u2019NT AUTHORITY\\SYSTEM\u2019, eludir productos de seguridad, robo de credenciales o compromiso total del sistema."}], "id": "CVE-2026-14961", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14961", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T19:30:44.030568Z", "version": "2.0.3"}}]}, "published": "2026-07-15T18:16:44.640", "references": [{"source": "cret@cert.org", "url": "https://kb.cert.org/vuls/id/529388"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-269"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[02-17-2025,02-17-2025]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Tdelo64.sys", "source": "cna", "vendor": "Pegatron Corp."}, "product": "tdelo64.sys", "vendor": "pegatron"}], "created": "2026-07-23T22:11:09.534280+00:00", "title": "Local Privilege Escalation via Unchecked Ioctl in Pegatron Tdelo64.sys Driver", "updated": "2026-07-31T03:15:04.330020+00:00", "vendors": ["pegatron", "pegatron$PRODUCT$tdelo64.sys"]}