A critical privilege escalation vulnerability in the Advantech SUSI driver allows local attackers to gain full system control via arbitrary memory and I/O manipulation.

This is an improper access control flaw (CWE-284) within the susi.sys driver. It allows an attacker with low privileges to read or write arbitrary memory, I/O ports, and Model Specific Registers (MSRs).

The ability to perform arbitrary memory and I/O operations grants an attacker full system control, bypassing standard security boundaries. With a CVSS score of 7.8, this high-severity vulnerability poses a significant threat to data confidentiality, integrity, and system availability. Successful exploitation could lead to full machine compromise, unauthorized data exfiltration, or the installation of persistent malicious payloads.

Immediate Action: Contact Advantech support or monitor the official PSIRT advisory portal for the release of a patched driver version. Until a patch is verified, restrict access to systems utilizing the affected SUSI driver to only trusted, authorized users.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access or load kernel-level drivers. Review endpoint detection and response (EDR) alerts for suspicious process activity originating from local user accounts.

Compensating Controls: Implement strict principle-of-least-privilege policies to ensure that standard users cannot interact with sensitive system drivers. Utilize kernel-mode code signing and driver blocklisting features to prevent the loading of known vulnerable or malicious drivers.

Public Exploit Available: No

Given the potential for full system compromise via arbitrary code execution, this vulnerability represents a significant risk to industrial or embedded environments using Advantech hardware. Administrators should prioritize identifying all systems running the affected SUSI driver version and prepare to deploy the vendor-supplied fix immediately upon release.