CVE-2026-14960
CRITICALPegatron Tdelo64.sys < 02-17-2025 - Unauthenticated Arbitrary Hardware I/O Port Read and Write via IOCTL Handlers
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-14960. PoCs published by FzRsLLaSheR.
AI-analyzed exploit summary Detailed technical analysis of two privilege escalation vulnerabilities (CVE-2026-14960 and CVE-2026-14961) in Pegatron's TdeIo64 driver (tdeio64.sys). The writeup explains improper access control and arbitrary kernel memory read/write primitives, enabling local SYSTEM privilege escalation and unrestricted hardware I/O port access.
Description
Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.
Exploits (1)
Detailed technical analysis of two privilege escalation vulnerabilities (CVE-2026-14960 and CVE-2026-14961) in Pegatron's TdeIo64 driver (tdeio64.sys). The writeup explains improper access control and arbitrary kernel memory read/write primitives, enabling local SYSTEM privilege escalation and unrestricted hardware I/O port access.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H