TcRouter.sys - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/tcrouter.sys/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:54:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTcRouter.sys: Local privilege escalation via arbitrary memory access (CVE-2026-18768)https://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18768/Wed, 11 Nov 2026 13:54:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18768/A local low-privileged attacker can exploit the TcRouter.sys driver via exposed IOCTL function calls to access or remap arbitrary physical memory, resulting in full system compromise.The TcRouter.sys driver contains a vulnerability (CVE-2026-18768) that allows local low-privileged users to interact with exposed IOCTL function calls. This flaw enables an attacker to access arbitrary physical memory or define memory mappings, which can be leveraged for full system compromise.

Impact

Successful exploitation allows a local user to escalate privileges to the kernel level, resulting in a full compromise of the affected device.

Recommendation

Prioritize identification of systems running the vulnerable TcRouter.sys driver and coordinate with the vendor to obtain and apply security updates. As the vulnerability involves kernel-mode driver exploitation, monitoring for unusual driver loads or IOCTL communication patterns originating from non-privileged processes is recommended.

]]>highadvisoryTcRouter.sys: Local privilege escalation via IOCTL (CVE-2026-18767)https://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18767/Wed, 11 Nov 2026 13:54:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-tcrouter-sys-privilege-escalation-cve-2026-18767/A local low-privileged attacker or process can exploit exposed IOCTL function calls in the TcRouter.sys driver to access I/O ports and achieve full system compromise.CVE-2026-18767 is a vulnerability in the TcRouter.sys driver that permits unauthorized access to I/O ports. By leveraging exposed IOCTL function calls, a low-privileged local actor can escalate privileges, leading to full system compromise. The vulnerability has a CVSS v3.1 base score of 7.8.

Impact

Successful exploitation allows a local attacker or process to move from low-privilege access to full system compromise.

Recommendation

  • Audit systems for the presence of the TcRouter.sys driver.
  • Implement monitoring for processes interacting with the driver via DeviceIoControl calls.
  • Prioritize patching if an updated driver version is released by the vendor.
]]>highadvisory