CVE-2014-9633

COMODO Backup <4.4.1.23 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-9633. PoCs published by Parvez Anwar.

AI-analyzed exploit summary This exploit leverages a null pointer dereference in Comodo Backup's bdisk.sys driver to achieve privilege escalation by overwriting the token of the current process with that of the SYSTEM process. It includes shellcode for both Windows XP and Windows 7.

Description

The bdisk.sys driver in COMODO Backup before 4.4.1.23 allows remote attackers to gain privileges via a crafted device handle, which triggers a NULL pointer dereference.

Exploits (1)

exploitdb WORKING POC
by Parvez Anwar · clocalwindows
https://www.exploit-db.com/exploits/35905

This exploit leverages a null pointer dereference in Comodo Backup's bdisk.sys driver to achieve privilege escalation by overwriting the token of the current process with that of the SYSTEM process. It includes shellcode for both Windows XP and Windows 7.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Comodo Backup 4.4.0.0 with bdisk.sys driver 1.0.0.957
No auth needed
Prerequisites: Access to a vulnerable version of Comodo Backup on Windows XP SP3 or Windows 7 SP1 (32-bit)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

EPSS 0.0721
EPSS Percentile 91.8%

Details

CWE
CWE-264
Status published
Products (1)
comodo/backup < 4.4.1
Published Feb 03, 2015
Tracked Since Feb 18, 2026