{"id":"CVE-2026-126785","kind":"vulnerability","aliases":["CVE-2026-126785"],"related":[],"title":"TR-VISION HOME: incorrect default permissions in fan manager driver","description":"A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"TR-VISION HOME 2.0.5 has a flaw in the WFanManager.sys driver's IOCTL handler where default permissions are set incorrectly. A local user on the machine can use it to gain more privileges than intended.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TR-VISION HOME","fixed":[],"affected":"2.0.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["driver","local-privilege-escalation","other","thermalright","tr-vision-home","windows"],"not_affected_if":["no-local-access","no-tr-vision-home"],"how_to_check":"- Check whether Thermalright TR-VISION HOME (legacy Frozen Vision software) is installed and its version is 2.0.5, the latest the vendor lists.\n- Look for WFanManager.sys on the machine (installed driver or loaded service).\n- The sources do not name other versions; earlier builds may also carry the driver but that is unconfirmed.","fix":"No fixed version: the vendor did not respond and its download page lists 2.0.5 as the latest. Until a patch ships, uninstall TR-VISION HOME and remove the WFanManager.sys driver service on shared or multi-user machines, or limit local logins.","status":"open","published_at":"2026-11-12T01:17:11+00:00","first_seen_at":"2026-11-12T01:39:26+00:00","triaged_at":"2026-11-12T01:40:11+00:00","updated_at":"2026-11-12T01:40:54+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T01:40:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"TR-VISION HOME: incorrect default permissions in fan manager driver","impact":"high","summary":"TR-VISION HOME 2.0.5 has a flaw in the WFanManager.sys driver's IOCTL handler where default permissions are set incorrectly. A local user on the machine can use it to gain more privileges than intended.","audience":"businesses","category":"other","nicknames":[],"who_cares":["tr-vision-home","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local user gains elevated privileges on the machine","analyst_note":"Confirm the fix status and affected driver versions from the NVD entry or vendor; the vendor did not respond to disclosure.","how_to_check":"- Check whether the installed TR-VISION HOME version is `2.0.5`\n- Look for `WFanManager.sys` on the machine\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-access"],"who_is_affected":"Machines running TR-VISION HOME 2.0.5 with the WFanManager.sys driver loaded. The attack needs local access, so exposure depends on who can log in to those machines. The sources do not say which configurations are affected beyond this.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000701,"input_tokens":4564,"output_tokens":490,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fix status and affected driver versions from the NVD entry or vendor; the vendor did not respond to disclosure.","search":"'-126785':14A,17A '-2026':13A,16A '11504':87C '2.0.5':38B,81C 'attack':105C 'carri':108C 'compon':94C 'contact':114C 'cve':12A,15A 'default':6A,50B,102C 'disclosur':118C 'driver':11A,22B,45B 'earli':115C 'escal':26B 'fan':9A 'flaw':41B 'found':74C 'function':85C 'gain':65B 'handler':48B,96C 'home':4A,21A,32B,37B,80C 'impact':82C 'incorrect':5A,54B,101C 'intend':69B 'ioctl':47B,95C 'lead':99C 'librari':90C 'local':24B,56B,110C 'local-privilege-escal':23B 'machin':60B 'manag':10A 'manipul':98C 'must':106C 'permiss':7A,51B,103C 'privileg':25B,67B 'respond':122C 'rmalright':76C 'set':53B 'sub':86C 'thermalright':28B 'tr':2A,19A,30B,35B,78C 'tr-vision':1A,18A,34B,77C 'tr-vision-hom':29B 'use':62B 'user':57B 'vendor':112C 'vision':3A,20A,31B,36B,79C 'vulner':71C 'way':125C 'wfanmanager.sys':44B,91C 'window':33B","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Thermalright TR-VISION HOME 2.0.5 (the control software for legacy Frozen Vision coolers) with the WFanManager.sys driver. The flaw is local only: someone must already be able to run code on the machine. Skip it if you do not use this software or no untrusted users can log in.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["home","trvisionhome"],"ptokens":["home","tr","vision"],"labels":["critical","driver","localprivilegeescalation","other","thermalright","trvisionhome","windows"],"campaign_type":null,"search_a":"'-126785':14A,17A '-2026':13A,16A 'cve':12A,15A 'default':6A 'driver':11A 'fan':9A 'home':4A,21A 'incorrect':5A 'manag':10A 'permiss':7A 'tr':2A,19A 'tr-vision':1A,18A 'vision':3A,20A","search_b":"'2.0.5':38B 'default':50B 'driver':22B,45B 'escal':26B 'flaw':41B 'gain':65B 'handler':48B 'home':32B,37B 'incorrect':54B 'intend':69B 'ioctl':47B 'local':24B,56B 'local-privilege-escal':23B 'machin':60B 'permiss':51B 'privileg':25B,67B 'set':53B 'thermalright':28B 'tr':30B,35B 'tr-vision':34B 'tr-vision-hom':29B 'use':62B 'user':57B 'vision':31B,36B 'wfanmanager.sys':44B 'window':33B","search_c":"'11504':87C '2.0.5':81C 'attack':105C 'carri':108C 'compon':94C 'contact':114C 'default':102C 'disclosur':118C 'earli':115C 'found':74C 'function':85C 'handler':96C 'home':80C 'impact':82C 'incorrect':101C 'ioctl':95C 'lead':99C 'librari':90C 'local':110C 'manipul':98C 'must':106C 'permiss':103C 'respond':122C 'rmalright':76C 'sub':86C 'tr':78C 'tr-vision':77C 'vendor':112C 'vision':79C 'vulner':71C 'way':125C 'wfanmanager.sys':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T01:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126785","severity":null,"published_at":"2026-11-12T01:17:11+00:00","modified_at":"2026-11-12T01:17:11+00:00","first_seen_at":"2026-11-12T01:39:26+00:00","fetched_at":"2026-11-12T01:39:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126785:3675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126785","severity":null,"published_at":"2026-11-12T01:40:54+00:00","modified_at":"2026-11-12T01:40:54+00:00","first_seen_at":"2026-11-12T01:40:54+00:00","fetched_at":"2026-11-12T01:40:54+00:00","note":"NVD (VulDB CNA) only; vendor (Thermalright) did not respond; its download page lists V2.0.5 as latest, so no fixed build known. No PoC or exploitation found. Nothing verified: no vendor advisory.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-126785","https://www.thermalright.com/support/download/"]}],"documents":[{"id":130914,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126785","title":"NVD CVE-2026-126785","kind":"advisory","source":"analyst","publisher":null,"text":"A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was contacted early about this disclosure but did not respond in any way. CVSS 4.0 9.3 (cna@vuldb.com).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":130915,"url":"https://www.thermalright.com/support/download/","title":"Thermalright TR-VISION HOME download page (latest V2.0.5)","kind":"vendor","source":"analyst","publisher":null,"text":"TR-VISION HOME Software, applicable to legacy (V1) Frozen Vision series liquid coolers. Latest Version: V2.0.5. Support OS: Windows 7/8/10/11 (32/64-bit).","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}