Local Privilege Escalation Vulnerability in Hangzhou Shunwang Rentdrv2 Software

CVE-2023-44976

What is CVE-2023-44976?

The software Rentdrv2 developed by Hangzhou Shunwang is vulnerable to a local privilege escalation that allows users to terminate endpoint detection and response (EDR) processes. This exploitation can lead to further impacts on the system, as seen in real-world attacks reported in October 2023. The vulnerability arises from the misuse of the DeviceIoControl function with control code 0x22E010, which has not yet been fully assessed for all potential exploits.

References