CVE-2008-5725
The NT kernel-mode driver (aka pstrip.sys) 5.0.1.1 and earlier in EnTech Taiwan PowerStrip 3.84 and earlier allows local users to gain privileges via certain IRP parameters in an IOCTL request to \Device\Powerstrip1 that overwrites portions of memory.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.85%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The NT kernel-mode driver (aka pstrip.sys) 5.0.1.1 and earlier in EnTech Taiwan PowerStrip 3.84 and earlier allows local users to gain privileges via certain IRP parameters in an IOCTL request to \Device\Powerstrip1 that overwrites portions of memory.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.85% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- entechtaiwan/powerstrip
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/33249Vendor Advisory
- http://securityreason.com/securityalert/4809
- http://www.ntinternals.org/ntiadv0810/ntiadv0810.htmlExploit
- http://www.securityfocus.com/bid/32961
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47532
- https://www.exploit-db.com/exploits/7533
- http://secunia.com/advisories/33249Vendor Advisory
- http://securityreason.com/securityalert/4809
- http://www.ntinternals.org/ntiadv0810/ntiadv0810.htmlExploit
- http://www.securityfocus.com/bid/32961
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47532
- https://www.exploit-db.com/exploits/7533
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.