CVE-2018-10712 describes a privilege escalation vulnerability in ASRock's AsrDrv101.sys and AsrDrv102.sys low-level drivers, affecting ASRock RGBLED, A-Tuning, F-Stream, and RestartToUEFI software. These drivers expose functionality to read/write data from/to IO ports, allowing a local attacker to execute arbitrary code with elevated privileges. Rated 7.8 HIGH on the CVSS scale, this vulnerability is easily exploitable with low attack complexity and requires only local user privileges, leading to high impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, exploit code is publicly available on ExploitDB, and it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.0.210CPE matchmatch criteria | cpe:2.3:a:asrock:a-tuning:*:*:*:*:*:*:*:* | ||
< 3.0.210CPE matchmatch criteria | cpe:2.3:a:asrock:f-stream:*:*:*:*:*:*:*:* | ||
< 1.0.6.2CPE matchmatch criteria | cpe:2.3:a:asrock:restart_to_uefi:*:*:*:*:*:*:*:* | ||
< 1.0.35.1CPE matchmatch criteria | cpe:2.3:a:asrock:rgbled:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.