CVE-2026-94142

8.8 HIGH

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: The vulnerability allows local manipulation of the PhysicalAddress argument, leading to a write-what-where condition in the BioStar Temperature Monitor Utility 1.2.1806.2200. This can result in arbitrary code execution.
Exploitability: Exploitation requires local access and manipulation of the PhysicalAddress argument. The vulnerability has a high attack vector and is locally exploitable.
Blast radius: If exploited, this vulnerability could lead to full system compromise, allowing an attacker to execute arbitrary code with the privileges of the affected process.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the latest version of BioStar Temperature Monitor Utility, specifically version 1.2.1806.2200 or later.

rcelocal-privilege-escalationfirmwareiot

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argument PhysicalAddress leads to write-what-where condition. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-119, CWE-123

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.