CVE-2021-21785

PoC —

CVSS 3.1

5.5 medium

EPSS

<1%p27

Published

Aug 5, 2021 (Aug 5, 2021)

Modified

Jun 17, 2026

Description

An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet (IRP) can lead to a disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability.

Vendors: iobit
Products: advanced systemcare ultimate
Weakness: CWE-782
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news1 stories

Vulnerability Spotlight: Information disclosure, privilege escalation vulnerabilities in IOBit Advanced SystemCare Ultimate

Cisco TalosJul 7, 20:41 UTC · Jul 7, 2021Vulnerability in the wildCVE-2021-21790 CVE-2021-21792 CVE-2021-21785+3 CVEs