Vulnerability Spotlight: Information disclosure, privilege escalation vulnerabilities in IOBit Advanced System Care Ultimate
Summary: Cisco Talos discovered multiple vulnerabilities in a monitoring driver in IOBit Advanced SystemCare Ultimate, a system optimizer for PCs. The flaws, tracked as TALOS-2021-1255 (CVE-2021-21790 through CVE-2021-21792), TALOS-2021-1252 (CVE-2021-21785), TALOS-2021-1254 (CVE-2021-21787 through CVE-2021-21789) and TALOS-2021-1253 (CVE-2021-21786), can be triggered by tricking a user into opening a specially crafted I/O request packet, allowing information disclosure and unprivileged users to obtain escalated privileges.
What you should know: Talos disclosed these flaws despite no official update from IOBit inside the 90-day deadline, and confirmed that version 14.2.0.220 of Advanced SystemCare Ultimate could be exploited. An unprivileged local user gaining escalated privileges on an endpoint is a direct path to deeper access, and the affected software is a consumer optimizer likely sitting on machines outside standard patch oversight.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-21785CVE-2021-21786CVE-2021-21787CVE-2021-21789CVE-2021-21790CVE-2021-21792
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026