CVE-2021-36924
📋 TL;DR
This vulnerability in Realtek RtsUpx USB Utility Driver allows local low-privileged users to execute arbitrary code with elevated privileges via a crafted Device IO Control packet. It affects systems using Realtek USB camera/hub/audio devices with vulnerable driver versions. Attackers can achieve privilege escalation, denial of service, or full system compromise.
💻 Affected Systems
- Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM/root privileges, enabling persistent backdoors, data theft, and lateral movement across the network.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install malware, or access restricted system resources.
If Mitigated
Limited to denial of service or failed exploitation attempts if proper endpoint protection and least privilege principles are enforced.
🎯 Exploit Status
Exploitation requires local access but low complexity once local access is obtained. Public technical details and proof-of-concept information available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.14.0.0
Vendor Advisory: https://www.realtek.com/images/safe-report/Realtek_RtsUpx_Security_Advisory_Report.pdf
Restart Required: Yes
Instructions:
1. Download updated driver from Realtek website or device manufacturer. 2. Uninstall current RtsUpx driver. 3. Install updated driver. 4. Restart system.
🔧 Temporary Workarounds
Restrict driver access
windowsModify driver permissions to restrict low-privileged user access
sc sdset RtsUpx D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
Disable vulnerable driver
windowsPrevent driver from loading via registry or group policy
reg add "HKLM\SYSTEM\CurrentControlSet\Services\RtsUpx" /v Start /t REG_DWORD /d 4 /f
🧯 If You Can't Patch
- Implement strict least privilege principles to limit local user access
- Deploy endpoint protection with driver control and exploit prevention capabilities
🔍 How to Verify
Check if Vulnerable:
Check driver version in Device Manager under 'System devices' for RtsUpx or run: driverquery | findstr RtsUpxCheck Version:
driverquery /v | findstr /i RtsUpxVerify Fix Applied:
Verify driver version is greater than 1.14.0.0 and test with known exploit attempts📡 Detection & Monitoring
Log Indicators:
- Windows Event ID 4697 (Service installed), suspicious driver loads, unexpected privilege escalation events
Network Indicators:
- Unusual outbound connections following local privilege escalation
SIEM Query:
EventID=4697 AND ServiceName="RtsUpx" OR ProcessName="RtsUpx.sys" AND CommandLine CONTAINS "IOCTL"