CVE-2026-14960

Deferred Deferred - Pending Action

Improper Hardware Access in Pegatron Tdelo64.sys Driver

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: CERT/CC

Description

Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-14960

EUVD

EUVD-2026-44730

Affected Vendors & Products

Vendor	Product	Version / Range
pegatron	tdeio64.sys	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

Executive Summary

CVE-2026-14960 is a privilege escalation vulnerability in the Pegatron tdeio64.sys driver. It exposes privileged hardware access functionality through an unprotected IOCTL interface. Unprivileged local attackers can send crafted requests to perform arbitrary hardware I/O port reads and writes without authorization checks.

Detection Guidance

To detect this vulnerability, check for the presence of the vulnerable driver file tdeio64.sys in the system's driver directory. Use commands like 'where /r C:\ tdeio64.sys' in Command Prompt or 'find / -name tdeio64.sys' in PowerShell. Additionally, monitor for unusual hardware I/O operations or unauthorized DeviceIoControl calls targeting the \\.\TdeIo device interface.

Impact Analysis

An attacker could exploit this to manipulate hardware registers, tamper with firmware, cause system instability, or gain persistent low-level access. This may lead to full system compromise, including privilege escalation to SYSTEM, disabling security controls, or installing rootkits.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system manipulation, violating compliance requirements for data protection and security controls in standards like GDPR and HIPAA.

Mitigation Strategies

Immediately disable or remove the vulnerable driver tdeio64.sys if found. Restrict untrusted user access to the driver. Enable Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI) to block the driver from loading. Monitor system logs for suspicious activity related to hardware I/O operations.

Hi! I’m here to help you understand CVE-2026-14960. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70