CVE-2024-33220

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-782

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
asus	aisuite3	3.03.36

References

https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33220Exploit, Third Party Advisory
https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33220Exploit, Third Party Advisory

Timeline

Published: May 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-332217.8An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and CVE-2024-332228.4An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execu CVE-2024-332238.8An issue in the component IOMap64.sys of ASUSTeK Computer Inc ASUS GPU TweakII v1.4.5.2 allows attackers to escalate privileges and execute CVE-2024-332248.4An issue in the component rtkio64.sys of Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 allows attackers to escalate privileg CVE-2024-332257.8An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows att CVE-2024-332269.9An issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges and e CVE-2024-332278.8An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via CVE-2024-332288.4An issue in the component segwindrvx64.sys of Insyde Software Corp SEG Windows Driver v100.00.07.02 allows attackers to escalate privileges CVE-2024-33238.3Cross Site Scripting in UI Request/Response Validation in TIBCO JasperReports Server 8.0.4 and 8.2.0 allows allows for the injection of CVE-2024-332315.4Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to th CVE-2024-332478.8Sourcecodester Employee Task Management System v1.0 is vulnerable to SQL Injection via admin-manage-user.php.CVE-2024-33257.2Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0.