{"id":"CVE-2026-94142","published":"2026-09-21T05:16:42.053","lastModified":"2026-09-21T20:17:40.953","description":"A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argument PhysicalAddress leads to write-what-where condition. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-123"],"vendors":[],"products":[],"references":[{"url":"https://vuldb.com/cve/CVE-2026-94142","tags":[]},{"url":"https://vuldb.com/submit/893919","tags":[]},{"url":"https://vuldb.com/vuln/408057","tags":[]},{"url":"https://vuldb.com/vuln/408057/cti","tags":[]},{"url":"https://vuldb.com/submit/893919","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The vulnerability allows local manipulation of the PhysicalAddress argument, leading to a write-what-where condition in the BioStar Temperature Monitor Utility 1.2.1806.2200. This can result in arbitrary code execution.","exploitability":"Exploitation requires local access and manipulation of the PhysicalAddress argument. The vulnerability has a high attack vector and is locally exploitable.","blast_radius":"If exploited, this vulnerability could lead to full system compromise, allowing an attacker to execute arbitrary code with the privileges of the affected process.","remediation":"Upgrade to the latest version of BioStar Temperature Monitor Utility, specifically version 1.2.1806.2200 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","local-privilege-escalation","firmware","iot"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T09:18:34.273Z"}}