CVE-2021-41285

CVE-2021-41285 describes a privilege escalation vulnerability in the Ballistix MOD Utility (versions through 2.0.2.5), specifically within its MODAPI.sys driver component. Low-privileged users can exploit this by sending a crafted IOCTL request, enabling direct interaction with physical memory via the MmMapIoSpace function. This allows an attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM. The vulnerability carries a CVSS score of 7.8 (HIGH), indicating a significant risk due to its low attack complexity (AC:L) and the potential for complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) from a local attacker (AV:L, PR:L). While there is no public exploit code available in Metasploit or ExploitDB, and it is not listed in CISA's KEV catalog, media coverage indicates this vulnerability has been leveraged by the "SteelFox" malware. This suggests active exploitation in the wild, despite a low EPSS score and limited community discussion.