CVE-2026-15430

MEDIUM

Wellbia XIGNCODE3 xhunter2.sys Improper Access Control Local Privilege Escalation

Generated titleSource: EIP title enrichment
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-15430 has a selected CVSS score of 6.2 (medium); EIP currently links 1 repository PoC.

Description

Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected security processes.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 3, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

XIGNCODE3

Browse Wellbia / XIGNCODE3
CVE List2026.6.1.192affected

Proofs of concept

1

Repository PoCs

GitHubBlackSnufkin/AxHunterRepository PoCby BlackSnufkin10Exploit36 files

726.0 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Rust workspace containing two exploit PoCs for Wellbia XIGNCODE3 anti-cheat drivers. AxHunter_v1 targets xhunter1.sys (CVE-2026-3609) and AxHunter_v2 targets xhunter2.sys (CVE-2026-15430). Both PoCs bypass driver authentication gates to obtain kernel-minted PROCESS_ALL_ACCESS handles, enabling credential dumping from lsass.exe, PPL-protected process termination, local privilege escalation to SYSTEM, and kernel-mode code injection.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files constitute a proof-of-concept exploit for two known CVEs in the XIGNCODE3 anti-cheat driver. The code implements documented exploit primitives (privilege escalation, credential dumping, process termination, code injection) against the vulnerable driver. No concealed backdoor, deceptive payload, or unrelated operator-directed harm was observed in the supplied source code.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRust
Target softwareWellbia XIGNCODE3 xhunter1.sysWellbia XIGNCODE3 xhunter2.sys
Attack typesprivilege escalationcredential dumpingprocess terminationcode injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary stated purpose is to exploit vulnerabilities in the xhunter driver family. The README explicitly describes the code as 'PoCs' and the source code implements full exploitation chains including authentication bypass, handle acquisition, credential dumping, process termination, privilege escalation, and code injection. The code is designed to be compiled and executed to achieve these effects, not merely to detect or report the vulnerability.

README.md:3axhunter_v1/src/main.rs:1axhunter_v2/src/main.rs:1

Requirements

  • The vulnerable xhunter1.sys or xhunter2.sys driver must be loaded and accessible via a device path.axhunter_v1/src/main.rs:85-90axhunter_v2/src/main.rs:141-144
  • The attacker must have local, unprivileged code execution on the target Windows system.README.md:3

Observed behavior

  • Bypasses the driver's authentication gate by sending specific IOCTL commands (cmd 777 + cmd 775 for v1; cmd 777 + cmd 779 + cmd 775 for v2) to set allowlist flags.axhunter_v1/src/main.rs:93-96axhunter_v2/src/main.rs:3-13
  • Obtains a kernel-minted PROCESS_ALL_ACCESS handle on any process, including PPL-protected ones, via cmd 785.axhunter_v1/src/main.rs:6-7axhunter_v2/src/main.rs:23-25
  • Dumps credentials (NT and SHA1 hashes, WDigest plaintext) from lsass.exe by reading its memory through the driver.axhunter_v1/src/main.rs:11axhunter_v2/src/main.rs:17
  • Terminates PPL-protected processes (e.g., MsMpEng.exe) by stomping their handles via cmd 800.axhunter_v1/src/main.rs:12axhunter_v2/src/main.rs:18-20
  • Escalates privileges to SYSTEM by injecting shellcode into a SYSTEM process (e.g., winlogon.exe) using the obtained handle.axhunter_v1/src/main.rs:13-14axhunter_v2/src/main.rs:21-25
  • Performs kernel-mode code injection via cmd 820, where the driver allocates RWX memory and creates a user thread in the target process.axhunter_v1/src/main.rs:15-16axhunter_v2/src/main.rs:26-30
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The PoC exploits CVE-2026-3609 and CVE-2026-15430 to achieve privilege escalation, credential extraction, process termination, and code injection via the vulnerable xhunter1.sys and xhunter2.sys drivers.This is the stated purpose of the artifact and matches the associated CVE descriptions. The behavior is consistent with a normal exploit PoC.README.md:3axhunter_v1/src/main.rs:1-23axhunter_v2/src/main.rs:1-37
Binary Limitation
Three binary files (xhunter1.sys, xhunter2.sys, wbmf_module.dll) are present in the repository but were not analyzed.These are the vulnerable driver binaries and a supporting DLL. Their content is opaque to this review, but their presence is expected for a driver exploit PoC.README.md:19
Review boundaries

What the analysis did not establish

  • Three binary files (xhunter1.sys, xhunter2.sys, wbmf_module.dll) are present but were not inspected; their content is flagged as binary and only metadata was analyzed.
  • Only 8 of 36 total files were selected for text analysis; 25 text files were omitted from the evidence packet.
  • The analysis is based solely on the provided source code and metadata; the code was not executed, and its actual runtime behavior or reliability cannot be confirmed.
  • Three binary files (xhunter1.sys, xhunter2.sys, wbmf_module.dll) were not analyzed and could contain additional behavior not visible in the source code.
  • Only 8 of 36 total files were reviewed; the remaining 28 files were omitted from the evidence packet and their content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2