The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.

When an IOCTL contains privileged functionality and is exposed unnecessarily, attackers may be able to access this functionality by invoking the IOCTL. Even if the functionality is benign, if the programmer has assumed that the IOCTL would only be accessed by a trusted process, there may be little or no validation of the incoming data, exposing weaknesses that would never be reachable if the attacker cannot call the IOCTL directly.
The implementations of IOCTLs will differ between operating system types and versions, so the methods of attack and prevention may vary widely.

Primary

Architecture and Design

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Integrity
Availability
Confidentiality
Varies by Context
Attackers can invoke any functionality that the IOCTL offers. Depending on the functionality, the consequences may include code execution, denial-of-service, and theft of data.

Architecture and Design
In Windows environments, use proper access control for the associated device or device namespace. See References.

CVE-2009-2208
Operating system does not enforce permissions on an IOCTL that can be used to modify network settings.
https://www.cve.org/CVERecord?id=CVE-2009-2208

CVE-2008-3831
Device driver does not restrict ioctl calls to its direct rendering manager.
https://www.cve.org/CVERecord?id=CVE-2008-3831

CVE-2008-3525
ioctl does not check for a required capability before processing certain requests.
https://www.cve.org/CVERecord?id=CVE-2008-3525

CVE-2008-0322
Chain: insecure device permissions allows access to an IOCTL, allowing arbitrary memory to be overwritten.
https://www.cve.org/CVERecord?id=CVE-2008-0322

CVE-2007-4277
Chain: anti-virus product uses weak permissions for a device, leading to resultant buffer overflow in an exposed IOCTL.
https://www.cve.org/CVERecord?id=CVE-2007-4277

CVE-2007-1400
Chain: sandbox allows opening of a TTY device, enabling shell commands through an exposed ioctl.
https://www.cve.org/CVERecord?id=CVE-2007-1400

CVE-2006-4926
Anti-virus product uses insecure security descriptor for a device driver, allowing access to a privileged IOCTL.
https://www.cve.org/CVERecord?id=CVE-2006-4926

CVE-1999-0728
Unauthorized user can disable keyboard or mouse by directly invoking a privileged IOCTL.
https://www.cve.org/CVERecord?id=CVE-1999-0728

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This can be primary to many other weaknesses when the programmer assumes that the IOCTL can only be accessed by trusted parties. For example, a program or driver might not validate incoming addresses in METHOD_NEITHER IOCTLs in Windows environments (CWE-781), which could allow buffer overflow and similar attacks to take place, even when the attacker never should have been able to access the IOCTL at all.

Because IOCTL functionality is typically performing low-level actions and closely interacts with the operating system, this weakness may only appear in code that is written in low-level languages.

CWE Content Team
MITRE
2009-07-15
1.5
2009-07-27

CWE Content Team
MITRE
2009-12-28
updated Time_of_Introduction

CWE Content Team
MITRE
2017-11-08
updated Likelihood_of_Exploit, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2021-03-15
updated Observed_Examples

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Common_Consequences

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities