CVE-2021-36923
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB device privileged IN and OUT instructions (leading to Escalation of Privileges, Denial of…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB device privileged IN and OUT instructions (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.28% probability · 21th percentile
- CISA KEV
- Not listed
- Affected
- realtek/rtsupx usb utility driver
- Source
- cve@mitre.org
References
- https://www.realtek.com/images/safe-report/Realtek_RtsUpx_Security_Advisory_Report.pdfVendor Advisory
- https://www.sentinelone.com/resources/category/report/Not Applicable
- https://www.realtek.com/images/safe-report/Realtek_RtsUpx_Security_Advisory_Report.pdfVendor Advisory
- https://www.sentinelone.com/resources/category/report/Not Applicable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.