A critical write-what-where vulnerability in the BioStar Temperature Monitor Utility allows local attackers to escalate privileges through malicious kernel memory manipulation.

The flaw exists in the BS_HWMIO64_W10.sys kernel-mode driver, specifically within the sub_1105C function of the IOCTL handler. By manipulating the PhysicalAddress argument, a local attacker can trigger a write-what-where condition, enabling arbitrary memory modification.

With a CVSS score of 8.8, this vulnerability represents a severe threat to system security. An attacker who gains local access can leverage this flaw to elevate their privileges to the kernel level, potentially disabling security agents or exfiltrating sensitive information from system memory.

Immediate Action: In the absence of a patch, assess the necessity of this utility and consider uninstalling it from sensitive environments if it is not mission-critical.

Proactive Monitoring: Monitor system logs for suspicious IOCTL requests targeting the BS_HWMIO64_W10.sys driver.

Compensating Controls: Deploy endpoint security policies that enforce strict execution control and monitor for anomalous behavior originating from hardware monitoring utilities.

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the vulnerability disclosure.

Organizations should treat this vulnerability with high urgency given the availability of public exploit code. Until BioStar releases a security update, administrative teams should restrict local access to affected machines and evaluate the risk of maintaining this software in production environments.