CVE-2018-10709 describes a privilege escalation vulnerability in several ASRock utility drivers, including AsrDrv101.sys and AsrDrv102.sys, affecting ASRock RGBLED, A-Tuning, F-Stream, and RestartToUEFI. These drivers expose functionality to read and write CR register values, which can be abused to execute code with elevated privileges. The vulnerability has a CVSS score of 7.8 (HIGH), indicating a local attack vector with low attack complexity, requiring low privileges, and leading to high impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, exploit code is publicly available on ExploitDB, and there has been some community discussion and media coverage, including an article by SecurityWeek.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.0.210CPE matchmatch criteria | cpe:2.3:a:asrock:a-tuning:*:*:*:*:*:*:*:* | ||
< 3.0.210CPE matchmatch criteria | cpe:2.3:a:asrock:f-stream:*:*:*:*:*:*:*:* | ||
< 1.0.6.2CPE matchmatch criteria | cpe:2.3:a:asrock:restart_to_uefi:*:*:*:*:*:*:*:* | ||
< 1.0.35.1CPE matchmatch criteria | cpe:2.3:a:asrock:rgbled:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.