Cyber Resilience

CVE-2024-39251

Published
01 July 2024
Modified
15 April 2026
CVSS Score v3.1 10.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0072 51th percentile
Risk Priority 75 floored blend · peak EPSS

Summary

CVE-2024-39251 is a critical-severity Exposed IOCTL with Insufficient Access Control (CWE-782) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, execute arbitrary code, or escalate privileges via sending crafted IOCTL requests.

CWE(s)
CWE-782

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-7771Shared CWE-782
CVE-2025-15641Shared CWE-782
CVE-2026-8797Shared CWE-782
CVE-2024-33219Shared CWE-782
CVE-2024-30804Shared CWE-782
CVE-2026-57851Shared CWE-782
CVE-2025-8061Shared CWE-782
CVE-2024-33221Shared CWE-782
CVE-2025-26125Shared CWE-782
CVE-2026-8501Shared CWE-782

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V8.2.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

AC-3 directly requires enforcement of access authorizations on system resources, which structurally stops an IOCTL from being exposed without proper controls.

AC-6 Least Privilege good match

AC-6 requires least-privilege assignments that limit which users or processes can reach privileged IOCTL functionality.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Directly enforces least-privilege access permissions on interfaces such as IOCTLs.

PR.IR-01 mostly match
prevents

Protects environments from unauthorized logical access, which includes improperly exposed IOCTL entry points.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect missing IOCTL authorization during development.

A.8.2 Privileged access rights partial match
prevents

Privileged access rights directly restrict who may invoke sensitive IOCTLs.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes design-time access-control requirements for device interfaces.

A.8.26 Application security requirements partial match
prevents

Application security requirements capture the need for proper IOCTL authorization.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture principles mandate least-privilege access to kernel interfaces.

A.8.28 Secure coding partial match
prevents

Secure coding practices prevent omission of access-control checks on IOCTL handlers.

References