Technical impact
A flaw in the LWBilling64.sys library of Yungengxin Cloud Billing exposes an IOCTL that terminates processes when supplied with an arbitrary Pid value. The inadequate access control on this interface allows an attacker to invoke the command locally and force the termination of any selected process, effectively disrupting application functionality or critical system services. The vulnerability does not allow arbitrary code execution or privilege escalation directly, but the ability to kill processes can be leveraged to deny service or create conditions for other attacks.
Affected Systems
The problem exists in Yungengxin Cloud Billing version 2024.11.28.11. The vulnerable component is the sub_14000443C function within LWBilling64.sys, which handles the process termination IOCTL. No additional versions or products are listed as affected at this time.
Risk and Exploitability
The CVSS score of 4.8 indicates a moderate impact when combined with the local nature of the attack. EPSS was not provided and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is not yet documented. Nevertheless, the exposed ioctl can be used immediately by local users with sufficient access, so the exploitation is straightforward and does not require complex prerequisites beyond local execution of the malicious command.
