Executive brief
A security vulnerability has been identified in a Pegatron hardware driver used to manage low-level system components. An attacker with basic access to a computer can exploit this driver to gain full control over the operating system, potentially leading to data theft, the installation of persistent malware, or system instability. Because the driver allows direct interaction with hardware, an attacker could bypass standard security protections usually enforced by Windows.
Technical details
The Pegatron Tdelo64.sys (also referred to as tdeio64.sys) kernel-mode driver contains an insecure IOCTL interface. The driver exposes the \\.\TdeIo device object without adequate access control lists (ACLs), allowing unprivileged user-mode applications to issue DeviceIoControl requests. Specifically, IOCTL handlers such as TDE_IOCTL_INDEXIO_READ and TDE_IOCTL_INDEXIO_WRITE permit arbitrary hardware I/O port interaction. A local attacker can leverage these primitives to manipulate hardware registers, tamper with firmware, or achieve full kernel-level privilege escalation (NT AUTHORITY\SYSTEM). As of publication, no patch is available, and mitigation involves blocking the driver via WDAC or HVCI.
Affected products
- Pegatron Corp. Tdelo64.sys Versions up to and including 2025-02-17
Timeline
- 2026-06-10: disclosed: Vendor notified by CERT/CC
- 2026-07-15: advisory: Public advisory released by CERT/CC and NVD