Executive brief
A vulnerability in the Protegent 360 antivirus software allows any local user, including those with restricted guest access, to gain full administrative control over the computer. The software's security driver fails to verify who is sending it commands, allowing malicious programs to disable antivirus protections or overwrite critical system files. This could lead to a total system takeover, permanent data loss, or the installation of persistent malware that bypasses standard security measures.
Technical details
The Protegent File Filter driver (pgsecdl.sys v9.0.0.1) in Protegent 360 v2.0.0.4 fails to implement proper security descriptors on its device objects, leading to a CWE-732 (Incorrect Permission Assignment) vulnerability. The driver exposes IOCTL interfaces with FILE_ANY_ACCESS, allowing any unprivileged local user to open a handle to the device. By sending specific IOCTLs, an attacker can disable process protection, bypass minifilter callbacks, or trigger kernel-mode file writes to protected directories like C:\Windows\system32 via ZwWriteFile. This allows a local attacker to escalate privileges to SYSTEM or cause a denial-of-service (BSOD).
Affected products
- Unistal Systems Pvt. Ltd. Protegent 360 2.0.0.4
Timeline
- 2026-05-21: disclosed: Initial researcher disclosure by DreadSec
- 2026-07-23: advisory: CVE-2026-38764 published