« Volver al listado

CVE-2018-10712

Estado: ModificadaAlta (7.8)—

The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Asrock — A-tuningAsrock — F-streamAsrock — Restart TO UefiAsrock — Rgbled

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-10712",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-10-30T18:29:00.533",
  "references": [
    {
      "url": "https://www.exploit-db.com/exploits/45716/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/45716/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges."
    },
    {
      "lang": "es",
      "value": "Los controladores de bajo nivel AsrDrv101.sys y AsrDrv102.sys en ASRock RGBLED en versiones anteriores a la v1.0.35.1, A-Tuning en versiones anteriores a la v3.0.210, F-Stream en versiones anteriores a la v3.0.210 y RestartToUEFI en versiones anteriores a la v1.0.6.2 exponen funcionalidades para leer/escribir datos al/desde los puertos IO. Esto podría aprovecharse de varias formas para elevar código con privilegios elevados."
    }
  ],
  "lastModified": "2026-06-17T01:34:33.623",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:asrock:a-tuning:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6623A404-385E-47D2-A340-C7C4B3D1E1D2",
              "versionEndExcluding": "3.0.210"
            },
            {
              "criteria": "cpe:2.3:a:asrock:f-stream:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97A0D2ED-D5AC-43A8-9688-74891FC4B47E",
              "versionEndExcluding": "3.0.210"
            },
            {
              "criteria": "cpe:2.3:a:asrock:restart_to_uefi:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D711801C-6723-4B85-94A7-7F075BEFEDF6",
              "versionEndExcluding": "1.0.6.2"
            },
            {
              "criteria": "cpe:2.3:a:asrock:rgbled:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B890FAC-A643-4DFF-8A4E-5EEB0122DE80",
              "versionEndExcluding": "1.0.35.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}