CVE-2021-21792

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet (IRP) can lead to privileged reads in the context of a driver which can result in sensitive information disclosure from the kernel. The IN instruction can read four bytes from the given I/O device, potentially leaking sensitive device data to unprivileged users.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-782

Affected software

Vendor	Product	Versions
n/a	IObit	IOBit Advanced SystemCare Ultimate 14.2.0.220

References

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1255Exploit, Third Party Advisory

Timeline

Published: Aug 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217938.8An out-of-bounds write vulnerability exists in the JPG sof_nb_comp header processing functionality of Accusoft ImageGear 19.8 and 19.9. A sp CVE-2021-217947.8An out-of-bounds write vulnerability exists in the TIF bits_per_sample processing functionality of Accusoft ImageGear 19.9. A specially craf CVE-2021-217959.8A heap-based buffer overflow vulnerability exists in the PSD read_icc_icCurve_data functionality of Accusoft ImageGear 19.9. A specially cra CVE-2021-217967.8An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause CVE-2021-217977.8An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a CVE-2021-217987.8An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted CVE-2021-217996.1Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a use CVE-2021-21804.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and CVE-2021-218006.1Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user v CVE-2021-218016.1This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craft CVE-2021-218026.1This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craft CVE-2021-218036.1This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craft