CVE-2020-36603

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calls, allowing local, unprivileged users to execute arbitrary code with SYSTEM privileges on Microsoft Windows systems. The mhyprot2.sys driver must first be installed by a user with administrative privileges.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/kagurazakasanae/Mhyprot2DrvControlThird Party Advisory
https://github.com/kkent030315/evil-mhyprot-cliThird Party Advisory
https://web.archive.org/web/20211204031301/https://www.godeye.club/2021/05/20/001-disclosure-mhyprot.htmlExploit, Third Party Advisory
https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.htmlExploit, Third Party Advisory
https://www.vice.com/en/article/y3p35w/hackers-are-using-anti-cheat-in-genshin-impact-to-ransom-victimsExploit, Press/Media Coverage, Third Party Advisory
https://github.com/kagurazakasanae/Mhyprot2DrvControlThird Party Advisory
https://github.com/kkent030315/evil-mhyprot-cliThird Party Advisory
https://web.archive.org/web/20211204031301/https://www.godeye.club/2021/05/20/001-disclosure-mhyprot.htmlExploit, Third Party Advisory
https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.htmlExploit, Third Party Advisory
https://www.vice.com/en/article/y3p35w/hackers-are-using-anti-cheat-in-genshin-impact-to-ransom-victimsExploit, Press/Media Coverage, Third Party Advisory

Timeline

Published: Sep 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-366048.1hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.CVE-2020-366054.4Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Ce CVE-2020-366076.1Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html t CVE-2020-366086.1A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown f CVE-2020-366095.4A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&CVE-2020-36619.8Buffer overflow will happen while parsing mp4 clip with corrupted sample atoms values which exceeds MAX_UINT32 range due to lack of validati CVE-2020-366108.0A vulnerability was found in annyshow DuxCMS 2.1. It has been declared as problematic. This vulnerability affects unknown code. The manipula CVE-2020-366117.1Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agen CVE-2020-366157.8An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously cra CVE-2020-366179.8A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_par CVE-2020-366189.8A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The ma CVE-2020-366199.8A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. Th