A local unprivileged user can craft certificate data to bypass the authentication checks in the tvk.sys driver of IRONMACE Ironshield. The driver mistakenly validates only publisher and root‑certificate strings instead of the PKCS signature, allowing the attacker to obtain privileged IOCTL access. This grants kernel‑level capabilities that could be used to manipulate system state or exfiltrate data.

The vulnerability is confined to IRONMACE Ironshield version 1.0.0.167. Only systems running this exact release are affected, and the flaw appears only when the tvk.sys driver is present.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is not available. The flaw is not listed in the CISA KEV catalog. Because the attack vector requires local, non‑privileged execution and crafted certificate data, the exploitation risk is limited to environments where the driver is installed. Still, a local attacker can achieve privilege escalation by sending specially crafted IOCTL calls after bypassing certificate checks.