The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus befor…

published 2003-12-31 22 y ago modified 2026-06-16 4 mo ago also EUVD-2003-1299

cvss: 10.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.4%; EPSS 2.4% chance of exploitation in 30 days, percentile 83%
public exploits: 0; none known

The DeviceIoControl function in the TrueVector Device Driver (VSDATANT) in ZoneAlarm before 3.7.211, Pro before 4.0.146.029, and Plus before 4.0.146.029 allows local users to gain privileges via certain signals (aka "Device Driver Attack").

Patch / fix

links 3

Exploit prediction

2.36% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

archives.neohapsis.com http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0070.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

References

osvdb.org /4362
vdb-entry, patch, vendor-advisory
osvdb.org /2375
vdb-entry, patch, vendor-advisory
secunia.com /advisories/9459
third-party-advisory, patch, vendor-advisory
archives.neohapsis.com /archives/vulnwatch/2003-q3/0070.html
mailing-list, exploit, vendor-advisory
securityfocus.com /bid/8342
vdb-entry, vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/12824
vdb-entry
download.zonelabs.com /bin/free/information/znalm/zaReleaseHistory.html
sec-labs.hack.pl /papers/win32ddc.php
sec-labs.hack.pl /advisories/seclabs-adv-zone-alarm-04-08-2003.txt

Sources

CVE List CVE-2003-1309
NVD CVE-2003-1309

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary