This vulnerability arises from improper input validation and missing authorization in the IOCTL handlers of the wsdkd.sys kernel driver in Watchdog Anti-Virus versions >=1.8.640 and <1.8.804 on Microsoft Windows. Local attackers with low privileges can send crafted IOCTL requests to the \Device\wsdk device, enabling them to delete arbitrary files with SYSTEM privileges. This bypasses normal NTFS access controls and could lead to disabling security software or causing system instability.

The vulnerability allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls. This can result in disabling security products or destabilizing the operating system, potentially leading to significant security and stability issues on affected systems.

No explicit patch or remediation details are provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious local activity targeting the \Device\wsdk device.