Improper Access Control in QILING Disk Master Kernel Driver

Executive Summary

CVE-2026-15476 is a security vulnerability in QILING Disk Master 6.0.0.0, specifically in the kernel driver component diskbckp.sys. The vulnerability arises because the driver exposes a device interface that allows local, non-administrative users to perform arbitrary raw disk writes without proper access control checks.

This means that an unprivileged user can write data directly to protected areas of the disk, such as system files or registry hives, bypassing Windows file system security mechanisms. The vulnerability is due to improper enforcement of security checks in the driver, allowing local privilege escalation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker with standard user privileges to escalate their privileges to administrative level by writing arbitrary data to protected disk locations.

Such unauthorized disk writes can compromise system integrity by overwriting critical system files or registry settings, potentially leading to system instability, unauthorized access, or persistent malware installation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the kernel driver diskbckp.sys version 6.0.0.0 exposing a device interface \\.\diskbakdrv1 that allows local users to perform arbitrary raw disk writes. Detection can focus on identifying the presence of this vulnerable driver and monitoring attempts to access the device interface or issue the specific IOCTL (0x810C2806) calls.

• Check if the vulnerable driver diskbckp.sys version 6.0.0.0 is loaded on the system using: sc query diskbckp
• List loaded drivers and filter for diskbckp.sys: driverquery | findstr diskbckp.sys
• Monitor for attempts to open the device interface \\.\diskbakdrv1 or issue IOCTL 0x810C2806 using Sysinternals Process Monitor or Windows Event Logs.
• Use PowerShell to check for the device interface: Get-Item -Path \\.\diskbakdrv1

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the affected component to a version where the vulnerability is fixed, as suggested by the vendor.

Additionally, restrict access to the vulnerable device interface by implementing secure device creation with restrictive security descriptors, ensuring only administrative users can access sensitive IOCTLs.

Avoid exposing raw disk access to untrusted or non-administrative users to prevent privilege escalation.

Useful 0 Not Useful 0