← Back to driver explorer
Driver intelligenceVulnerableVerified
cg6kwin2k.sys
Sangoma cg6kwin2k versions before 2.1.7.0 expose IOCTLs without sufficient access control. A low-privilege user can perform I/O against arbitrary hardware ports or physical addresses, enabling firmware erasure or modification.
Known samples 2
0 recorded TRUE · 2 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
cg6kwin2k.sysSample 1 · HVCI FALSE
- MD5
e3d290406de40c32095bd76dc88179fb- SHA1
06ec62c590ca0f1f2575300c151c84640d2523c0- SHA256
223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a1- Imphash
6c42ea981bc29a7e2ed56d297e0b56dc- Authentihash MD5
fe2bb16274052394a433f202b2f2c556- Authentihash SHA1
65980c174fc4930339ca81f70667439ad10b85cc- Authentihash SHA256
8c33314792854eef6c6cc4bd1cc4b00f1feed35e8bd260dd4ab0d93b1f6165af- Machine
- AMD64
- Version
- 2.00 built by: Administrator
- Publisher
- NMS Communications
cg6kwin2k.sysSample 2 · HVCI FALSE
- MD5
a82109dc70202686416ba5fdefe667f5- SHA1
f30e4838787e43d035fe2bb1b667f129b45b4452- SHA256
e054f61bb54672b374c6ac0f5d8176407ba43d397bc624ec40e281909724e6c7- Imphash
6c42ea981bc29a7e2ed56d297e0b56dc- Authentihash MD5
49f8506a50c28694bb878a3163e698f7- Authentihash SHA1
6843ada92357ed403ca2dfe8f12810cc64bddcd1- Authentihash SHA256
24944dd620dc265f435cbac929b3078c72b328dae4a52e95af40e170760c4426- Machine
- AMD64
- Version
- 2.00 built by: Administrator
- Publisher
- NMS Communications
Recorded command
sc.exe create cg6kwin2ksys binPath= C:\windows\temp\cg6kwin2ksys.sys type=kernel && sc.exe start cg6kwin2ksysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
Acknowledgement: fluffycats31 @fluffycats31