An issue in the TVicPort64.sys driver of EnTech Taiwan’s TVicPort Product allows an attacker to elevate privileges by sending crafted IOCTL 0x80002008 requests. The vulnerability arises from improper input validation and access control in the driver’s IOCTL handling routine. The description indicates that an attacker can send these requests to gain SYSTEM rights, but the exact attack vector is not specified; it is inferred that a local user or process with access to the driver could potentially exploit this flaw.

EnTech Taiwan TVicPort, version 4.0, driver TVicPort64.sys file version 5.2.1.0 are the impacted items. No other vendors or products are listed.

The vulnerability has no publicly available EPSS data and is not listed in the CISA KEV catalog, indicating it is not yet known to be actively exploited. Exploitation would require sending a crafted IOCTL to the device driver; the description does not disclose a remote interface, so it is inferred that a local attacker or an application with driver access would need to perform this step. In the absence of a vendor patch, the risk remains significant for systems running the vulnerable driver.