CWE · MITRE source
CWE-782Exposed IOCTL with Insufficient Access Control
The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
When an IOCTL contains privileged functionality and is exposed unnecessarily, attackers may be able to access this functionality by invoking the IOCTL. Even if the functionality is benign, if the programmer has assumed that the IOCTL would only be accessed by a trusted process, there may be little or no validation of the incoming data, exposing weaknesses that would never be reachable if the attacker cannot call the IOCTL directly. The implementations of IOCTLs will differ between operating system types and versions, so the methods of attack and prevention may vary widely.
Last updated: 14 October 2026 20:41 UTC
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
| No NIST controls proposed yet. | |||
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2021-21551 KEV UPD | 8.8 | 8.8 | 0.7925 | 2021-05-04 |
CVE-2024-32370 UPD | 7.5 | 9.8 | 0.0104 | 2024-05-07 |
CVE-2024-39251 UPD | 7.5 | 10.0 | 0.0072 | 2024-07-01 |
CVE-2024-30804 UPD | 7.4 | 9.8 | 0.0082 | 2024-04-26 |
CVE-2024-4196 UPD | 7.4 | 10.0 | 0.0059 | 2024-06-25 |
CVE-2024-33220 UPD | 6.7 | 8.8 | 0.0070 | 2024-05-22 |
CVE-2026-84408 | 6.6 | 8.8 | 0.0063 | 2026-09-16 |
CVE-2021-21787 UPD | 6.1 | 8.8 | 0.0034 | 2021-07-07 |
CVE-2021-21788 UPD | 6.1 | 8.8 | 0.0032 | 2021-07-07 |
CVE-2021-21789 UPD | 6.1 | 8.8 | 0.0032 | 2021-07-07 |
CVE-2024-33222 UPD | 6.1 | 8.4 | 0.0019 | 2024-05-22 |
CVE-2026-36355 UPD | 5.9 | 7.7 | 0.0056 | 2026-05-05 |
CVE-2021-21786 UPD | 5.8 | 7.8 | 0.0029 | 2021-07-07 |
CVE-2023-35841 UPD | 5.8 | 7.8 | 0.0035 | 2024-05-14 |
CVE-2021-25695 UPD | 5.7 | 7.8 | 0.0028 | 2021-07-21 |
CVE-2024-33218 UPD | 5.7 | 7.8 | 0.0021 | 2024-05-22 |
CVE-2024-33219 UPD | 5.7 | 7.8 | 0.0026 | 2024-05-22 |
CVE-2026-8501 UPD | 5.7 | 7.8 | 0.0019 | 2026-06-01 |
CVE-2024-33221 UPD | 5.6 | 7.8 | 0.0018 | 2024-05-22 |
CVE-2026-57851 | 5.6 | 7.8 | 0.0017 | 2026-07-07 |
CVE-2026-9492 | 5.6 | 7.8 | 0.0016 | 2026-07-13 |
CVE-2026-38765 | 5.6 | 7.8 | 0.0014 | 2026-07-22 |
CVE-2026-38766 | 5.6 | 7.8 | 0.0014 | 2026-07-22 |
CVE-2026-38764 | 5.6 | 7.8 | 0.0015 | 2026-07-23 |
CVE-2026-80116 | 5.6 | 7.8 | 0.0017 | 2026-09-04 |