Satoshi Tanda

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a security-feature bypass vulnerability in the Hypervisor-Protected Code Integrity (HVCI) feature of the Windows operating system. This vulnerability allows attackers to bypass existing security restrictions, potentially enabling arbitrary kernel-mode code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Hyper-V (affected versions not specified) **Description** The issue is related to insufficient access control in the Windows Hyper-V hardware virtualization system, which can be exploited to elevate privileges. An elevation-of-privilege vulnerability allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KINGSOFT Internet Security 9 Plus version 2010.06.23.247 **Description** The issue is related to the kernel mode driver kwatch3, which fails to properly handle crafted inputs. This failure leads to a stack-based buffer overflow. The exploitation of this issue may allow an attacker to execute arbitrary code. **Recommendations** For KINGSOFT Internet Security 9 Plus version 2010.06.23.247, consider disabling the kwatch3 driver as a temporary workaround until a patch is available. Restrict access to the kwatch3 driver to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Dell dbutil 2 3.sys driver (affected versions not specified) **Description** The Dell `dbutil 2 3.sys` driver contains an insufficient access control vulnerability. This issue allows a local authenticated user to escalate privileges, cause a denial of service, or disclose protected information. In real-world incidents, the Lazarus group exploited this flaw using a Bring Your Own Vulnerable Driver (BYOVD) technique—where a legitimate but vulnerable driver is installed on the target system—to deploy the FudModule rootkit. This allowed the attackers to read and write kernel memory, effectively disabling multiple Windows security monitoring mechanisms to execute commands with kernel-level privileges. The campaign targeted individuals in the aerospace industry in the Netherlands and political journalists in Belgium via phishing emails disguised as job offers from Amazon. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ASUS UX360CA BIOS versions through 303 Description: The issue allows an attacker with ring 0 privilege to overwrite nearly arbitrary physical memory locations, including SMRAM, and execute arbitrary code in the SMM. Recommendations: For ASUS UX360CA BIOS versions through 303, update to a version later than 303 to resolve the issue. As a temporary workaround, consider restricting access to ring 0 privilege to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Norman Security Suite versions 10.1 and earlier **Description** The issue allows local users to gain privileges via unknown vectors. **Recommendations** For Norman Security Suite versions 10.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Kingsoft Internet Security version 2011 **Description** The issue is related to an unspecified vulnerability in the device driver, allowing local users to cause a denial of service via a crafted application. **Recommendations** For Kingsoft Internet Security version 2011, at the moment, there is no information about a newer version that contains a fix for this vulnerability.