ArgusMonitor.sys in Argotronic eGbR ArgusMonitor exposes an improper access control flaw that allows local users with low privileges to bypass device handle restrictions. By exploiting a TOCTOU condition in the IRP_MJ_CREATE routine, a malicious user can send a specially crafted IOCTL 0x9C4024A8 request, which in turn forces the driver to terminate unexpectedly, resulting in a denial of service. The vulnerability lies primarily in the incorrect validation of device access and can be used to incapacitate the monitored device, though it does not provide remote code execution or steal data.

The flaw affects Argotronic eGbR ArgusMonitor version 7.4.02 and earlier. All releases prior to the mentioned version are potentially impacted.

The CVE has a CVSS score of 5.3, indicating a moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation activity. However, the attack requires only local low‑privileged access, which many users may possess on the system. Because the flaw leads to a service outage, an attacker could disrupt critical monitoring functions and potentially conduct a larger denial‑of‑service attack if the device is part of an industrial control system. The lack of broader exploitation data means uncertainty remains about the current threat landscape.