# Pegatron tdeio64.sys driver flaw enables SYSTEM access

Published: 2026-07-15 · Severity: medium · Sectors: technology, manufacturing
Canonical: https://vorant.io/reports/e88d7641-dacd-58c7-b1e5-1ac680e9fb87/pegatron-tdeio64-sys-driver-flaw-enables-system-access

> Unpatched Pegatron tdeio64.sys driver lets local attackers abuse IOCTL dispatch to gain arbitrary kernel read/write and escalate to SYSTEM.

CERT/CC disclosed two vulnerabilities in Pegatron's tdeio64.sys Windows driver, a WDM driver providing low-level hardware I/O access via the \\.\TdeIo device interface. The driver fails to validate the origin or permissions of user-supplied IOCTL requests, allowing an unprivileged local attacker to send crafted DeviceIoControl calls that grant arbitrary kernel memory read and write primitives. CVE-2026-14961 covers the memory read/write escalation path, which can be leveraged to overwrite a process token with the SYSTEM token, achieving NT AUTHORITY\SYSTEM privileges. CVE-2026-14960 covers exposed IOCTLs that permit direct hardware I/O port manipulation beyond normal OS protections.

Successful exploitation gives an attacker full kernel-level compromise: disabling or bypassing endpoint security, dumping credentials from protected processes like lsass.exe, installing persistent rootkits, and manipulating kernel structures. This is a classic "bring your own vulnerable driver" (BYOVD) scenario, where a signed but flawed driver is loaded to escalate privileges and evade detection.

No vendor-supported fix is currently available. CERT/CC recommends removing or disabling the driver where not needed, restricting untrusted users from interacting with it, and using Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI) with vulnerable driver blocklists to prevent it from loading.

## Mentioned in this report

- Vulnerabilities: CVE-2026-14960, CVE-2026-14961

## Detection guidance (public sample)

### Vulnerable Pegatron tdeio64.sys Driver Loaded

ATT&CK: T1068

Detects the signed-but-vulnerable Pegatron tdeio64.sys WDM driver being loaded into the kernel, a required BYOVD precursor step before the DeviceIoControl exploitation primitives can be used. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Vulnerable Pegatron tdeio64.sys Driver Loaded
description: Detects loading of the Pegatron tdeio64.sys driver (CVE-2026-14960/14961),
  which lacks IOCTL origin validation and can be abused for arbitrary kernel read/write,
  token overwrite to SYSTEM, and lsass credential dumping. Loading of this driver
  outside of Pegatron OEM utility contexts is a strong BYOVD indicator.
tags:
- attack.privilege-escalation
- attack.defense-evasion
- attack.t1068
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \tdeio64.sys
  condition: selection
falsepositives:
- Legitimate Pegatron/OEM hardware diagnostic or monitoring utilities that ship and
  load this driver on supported systems
level: high
id: c589e9d5-2871-5e6f-b22e-dd234e5a6618
status: experimental
author: Vorant
```

### Service Creation Registering tdeio64.sys Kernel Driver

ATT&CK: T1543.003

Detects creation of a Windows service pointing its ImagePath at tdeio64.sys, the mechanism an attacker uses to get the vulnerable signed driver loaded (bring-your-own-vulnerable-driver). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Service Creation Registering tdeio64.sys Kernel Driver
description: Detects registration of a new Windows service whose binary path references
  tdeio64.sys. Attackers create/register the driver as a kernel service (sc.exe create
  or direct registry write) to get the vulnerable Pegatron driver loaded so its unauthenticated
  IOCTLs can be reached via \\.\TdeIo.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1543.003
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Services\
    TargetObject|endswith: \ImagePath
    Details|contains: tdeio64.sys
  condition: selection
falsepositives:
- OEM-supplied installer for legitimate Pegatron hardware diagnostic software on systems
  where the driver is a supported dependency
level: high
id: 9b6debf8-2262-569f-b86b-5cd596b85412
status: experimental
author: Vorant
```

### Process Accessing LSASS Memory Following Kernel Driver Exploitation Context

ATT&CK: T1003.001

Detects a process obtaining high-privilege memory-read access to lsass.exe, consistent with credential dumping enabled after SYSTEM-level compromise via the tdeio64.sys kernel read/write primitive. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Process Accessing LSASS Memory Following Kernel Driver Exploitation Context
description: Detects processes requesting memory-read-capable access rights to lsass.exe.
  In the tdeio64.sys BYOVD scenario, an attacker who has overwritten their process
  token to SYSTEM via the driver's kernel read/write primitive can then open lsass.exe
  directly (bypassing normal protected-process/PPL restrictions) to dump credentials.
  Generalises on the GrantedAccess pattern rather than any specific tool name.
tags:
- attack.credential-access
- attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    GrantedAccess|contains:
    - '0x1010'
    - '0x1410'
    - '0x1438'
    - '0x143a'
    - '0x1f1fff'
  filter_known_tools:
    SourceImage|endswith:
    - \MsMpEng.exe
    - \wmiprvse.exe
    - \werfault.exe
    - \dumpservice.exe
  condition: selection and not filter_known_tools
falsepositives:
- Endpoint security or crash-dump utilities that legitimately open lsass.exe with
  broad access rights
- EDR agents performing memory scanning of lsass.exe
level: medium
id: 7ea0d506-ceb7-5394-aa40-ddf0965a115b
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/529388

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e88d7641-dacd-58c7-b1e5-1ac680e9fb87/pegatron-tdeio64-sys-driver-flaw-enables-system-access.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup