The vulnerability in Wellbia XIGNCODE3's xhunter1.sys kernel driver versions 10.0.10011.16384 through 2023.12.7.78 involves improper privilege management (CWE-269) that exposes the IRP_MJ_WRITE command interface. This flaw allows any user-level process to escalate privileges by requesting PROCESS_ALL_ACCESS, potentially gaining extensive control over processes. Despite a prior advisory (KVE 2023-5589) targeting version 10.0.10011.16384, the vulnerability remains unpatched in subsequent versions including 2023.12.7.78. The CVSS 3.1 base score is 5.3 (medium severity) reflecting local attack vector with low complexity, requiring low privileges but no user interaction, impacting confidentiality, integrity, and availability at a low level. No known exploits in the wild have been reported, and no official patch or remediation guidance is currently available.

Successful exploitation allows a user process to gain PROCESS_ALL_ACCESS rights, effectively enabling privilege escalation on the affected system. This can lead to unauthorized access and potential manipulation of other processes, impacting system confidentiality, integrity, and availability to a limited degree. The vulnerability is local and requires low privileges to exploit but does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the previously issued advisory (KVE 2023-5589) did not fully remediate the vulnerability, users should monitor Wellbia's official channels for updates. Until a fix is available, restricting access to the vulnerable driver and limiting user privileges may reduce risk, but no definitive mitigation is provided by the vendor at this time.