LiveActive security incident?Get immediate response
CVE Record

CVE-2021-42205: ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers...

ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice.

MediumCVSS 4.7Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a local denial-of-service issue in ELAN Miniport touchpad Windows drivers before 24.21.51.2. A user with local access could crash the system. It does not indicate data theft or privilege escalation, but it can disrupt endpoint availability.

Executive priority

Treat as a moderate endpoint stability risk. It should be handled through normal driver patch management, with higher priority for shared devices, kiosks, or systems where an outage has operational impact.

Technical view

The driver mishandles a specific IOCTL request by processing it twice, categorized as CWE-703. CVSS 3.1 is 4.7: local attack vector, high complexity, low privileges, no user interaction, and high availability impact only.

Likely exposure

Exposure is likely limited to Windows PCs using the ELAN Miniport touchpad driver before 24.21.51.2. The source states it is used by multiple PC manufacturers, but the provided data does not name affected OEM models.

Exploitation context

The supplied sources do not show active exploitation, and this CVE is not listed as KEV in the bundle. Exploitation requires local access and low privileges, with impact limited to crashing the system.

Researcher notes

Evidence is narrow: the affected component, fixed version threshold, IOCTL handling flaw, and CVSS details are available, but product/OEM mapping and exploitation evidence are not supplied. Avoid assuming broader impact beyond ELAN Miniport touchpad Windows drivers.

Mitigation direction

  • Update ELAN Miniport touchpad Windows driver to 24.21.51.2 or later.
  • Use OEM or ELAN guidance for approved driver packages.
  • Prioritize managed Windows laptops with ELAN touchpad drivers.
  • Restrict local interactive access on shared or high-availability endpoints.

Validation and detection

  • Inventory Windows endpoints for ELAN Miniport touchpad driver presence.
  • Check installed driver versions against 24.21.51.2.
  • Confirm OEM model coverage because affected manufacturers are not listed.
  • Review endpoint crash telemetry for unexplained driver-related system crashes.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-703: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-42205 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.7 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.7CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.7Medium
CVSS 3.1 vector shape for CVE-2021-42205Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

CWE-703

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-703 · source CWE mapping

Improper Check or Handling of Exceptional Conditions

Improper Check or Handling of Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs