{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atcrouter.sys/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:*:tcrouter.sys:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-18768"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TcRouter.sys"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe TcRouter.sys driver contains a vulnerability (CVE-2026-18768) that allows local low-privileged users to interact with exposed IOCTL function calls. This flaw enables an attacker to access arbitrary physical memory or define memory mappings, which can be leveraged for full system compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local user to escalate privileges to the kernel level, resulting in a full compromise of the affected device.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize identification of systems running the vulnerable TcRouter.sys driver and coordinate with the vendor to obtain and apply security updates. As the vulnerability involves kernel-mode driver exploitation, monitoring for unusual driver loads or IOCTL communication patterns originating from non-privileged processes is recommended.\u003c/p\u003e\n","date_modified":"2026-11-11T13:54:48Z","date_published":"2026-11-11T13:54:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18768/","summary":"A local low-privileged attacker can exploit the TcRouter.sys driver via exposed IOCTL function calls to access or remap arbitrary physical memory, resulting in full system compromise.","title":"TcRouter.sys: Local privilege escalation via arbitrary memory access (CVE-2026-18768)","url":"https://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18768/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:*:tcrouter.sys:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-18767"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TcRouter.sys"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-18767 is a vulnerability in the TcRouter.sys driver that permits unauthorized access to I/O ports. By leveraging exposed IOCTL function calls, a low-privileged local actor can escalate privileges, leading to full system compromise. The vulnerability has a CVSS v3.1 base score of 7.8.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local attacker or process to move from low-privilege access to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit systems for the presence of the TcRouter.sys driver.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for processes interacting with the driver via DeviceIoControl calls.\u003c/li\u003e\n\u003cli\u003ePrioritize patching if an updated driver version is released by the vendor.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:54:41Z","date_published":"2026-11-11T13:54:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18767/","summary":"A local low-privileged attacker or process can exploit exposed IOCTL function calls in the TcRouter.sys driver to access I/O ports and achieve full system compromise.","title":"TcRouter.sys: Local privilege escalation via IOCTL (CVE-2026-18767)","url":"https://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18767/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:*:tcrouter.sys:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}