CVE-2022-42045
MEDIUM EXPLOITEDZemana AntiMalware and Watchdog Anti-Malware - Arbitrary Code Injection
Title source: llmExploitation Summary
CVE-2022-42045 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including ReCryptLLC.
AI-analyzed exploit summary This PoC demonstrates a local privilege escalation (LPE) vulnerability in Zemana Anti-Malware's kernel driver (amsdk.sys, zam64.sys, zamguard64.sys) by injecting arbitrary shellcode into a driver section with RWX permissions and executing it in kernel mode. The exploit leverages IOCTL calls to manipulate driver memory and bypass security mechanisms like Driver Signature Enforcement.
Description
Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28.
Exploits (1)
This PoC demonstrates a local privilege escalation (LPE) vulnerability in Zemana Anti-Malware's kernel driver (amsdk.sys, zam64.sys, zamguard64.sys) by injecting arbitrary shellcode into a driver section with RWX permissions and executing it in kernel mode. The exploit leverages IOCTL calls to manipulate driver memory and bypass security mechanisms like Driver Signature Enforcement.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H