The SignalRGB kernel driver creates the \\.\SignalIo device object without an explicit SDDL security descriptor and without enabling FILE_DEVICE_SECURE_OPEN. This oversight constitutes an Improper Access Control weakness (CWE-284), resulting in an overly permissive default access control list that allows any authenticated local user to open a handle to the device and issue privileged IOCTL commands. As a result, attackers can modify hardware settings or elevate privileges without needing a remote connection or elevated credentials.

SignalRGB kernel driver versions earlier than 1.3.7.0 are impacted. The vulnerability affects the driver that manages the \\.\SignalIo device under Windows operating systems.

The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Nevertheless, the flaw can be leveraged by any local authenticated user, requiring no additional preconditions beyond local credentials. The lack of FILE_DEVICE_SECURE_OPEN and a missing SDDL means the attack can be performed directly by accessing the device, giving attackers the means to execute privileged operations and potentially compromise system integrity.