IOBit Unlocker Driver Vulnerability Allows Unauthorized File Access
CVE-2020-14974

7.1HIGH

Key Information:

Vendor

Iobit

Status
Iobit Unlocker
Vendor
CVE Published:
23 June 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-14974?

A vulnerability in IOBit Unlocker 1.1.2 allows low-privileged users to bypass security mechanisms by unlocking files and terminating processes, including those running with SYSTEM privileges. This is achieved through a specific IOCTL code, enabling unauthorized control over file handling. Users are encouraged to update to unaffected versions to mitigate risks associated with this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-14974
Created by Aterror2be

References

https://www.iobit.com/en/iobit-unlocker.php
x_refsource_MISC
https://theevilbit.github.io/posts/
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.