Security readout for executives and security teams
Plain-English summary
This vulnerability can let a local user crash a Windows system running 2345 Security Guard 3.6 by abusing its kernel driver. The sources do not provide a severity score, patch, or evidence of active exploitation.
Executive priority
Treat this as a targeted endpoint stability risk, not a confirmed remote compromise issue. Prioritize finding installed copies and deciding whether the software is still needed, especially on operationally important Windows systems.
Technical view
CVE-2018-8874 affects the 2345Wrath.sys driver in 2345 Security Guard 3.6. The driver does not validate input values for IOCTL 0x00222054, allowing local denial of service through a BSOD and possibly unspecified other impact.
Likely exposure
Exposure appears limited to systems with 2345 Security Guard 3.6 installed and the 2345Wrath.sys driver present or loaded. The provided CVE metadata does not list broader affected versions or CPEs.
Exploitation context
The CVE references public GitHub proof-of-concept material focused on BSOD. CISA KEV status is false, and the provided sources do not support claims of active exploitation in the wild.
Researcher notes
The public record is sparse: no CVSS, CWE, CPE, patch reference, or confirmed exploitation signal is included. Analysis should stay constrained to local DoS via the named driver and IOCTL validation weakness.
Mitigation direction
- Check vendor guidance for an official fix or supported mitigation.
- Inventory endpoints for 2345 Security Guard 3.6.
- Remove or upgrade the product if vendor guidance recommends it.
- Restrict local access on systems that must keep the software.
- Prioritize systems where crashes would disrupt critical operations.
Validation and detection
- Confirm whether 2345 Security Guard 3.6 is installed.
- Check whether 2345Wrath.sys exists or is loaded.
- Review crash logs for BSODs linked to 2345Wrath.sys.
- Verify whether vendor advisories identify patched versions.
- Document any business dependency before removal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-8874 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/D0neMkj/POC_BSOD/tree/master/2345%20security%20guard/0x00222054CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.