CVE-2017-9769: Razer Synapse rzpnk.sys IOCTL allows arbitrary process handle opening

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityPublic exploit code exists and EPSS is very high, but the record does not confirm active exploitation or KEV listing and the required access level is unclear.

What it is

The rzpnk.sys driver shipped with Razer Synapse 2.20.15.1104 forwards a specially crafted IOCTL to ZwOpenProcess, letting a caller obtain a handle to an arbitrary process. Because the driver exposes this primitive without validating the request, a local attacker can use it to reach processes they should not be able to touch. The record gives no affected-version range beyond the single stated Synapse build and no vendor fix detail.

Impact

An attacker gains a handle to any chosen process, which can be used to read or manipulate that process's memory and escalate privileges or tamper with security software. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is reached by sending a crafted IOCTL to the rzpnk.sys driver, which is a local driver interface rather than a network service. The CVSS vector is AV:N/PR:N/UI:N, but the description describes a local IOCTL path, so the vector and the described mechanism do not agree; treat the required access level as unresolved from this record.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.85539 (99.71st percentile) and three references are tagged Exploit, including a Rapid7 Metasploit module and an Exploit-DB entry, indicating public exploit code exists.

What to do

• Update or remove Razer Synapse 2.20.15.1104 and the rzpnk.sys driver; the record does not state a fixed version, so confirm the current vendor release before relying on it.
• If Synapse is not required, uninstall it and delete or block the rzpnk.sys driver.
• Restrict driver loading on endpoints so only signed, allowlisted drivers can load.
• Monitor for and block the known Metasploit module and Exploit-DB proof-of-concept behavior on hosts running the driver.

Detection

• Alert on rzpnk.sys being loaded on hosts where Razer Synapse is not expected.
• Hunt for processes opening handles to high-value targets such as lsass.exe or security tools from unexpected parent processes.
• Monitor for the Rapid7 Metasploit module windows/local/razer_zwopenprocess or matching Exploit-DB 42368 artifacts.
• Audit endpoints for the presence of Razer Synapse 2.20.15.1104 and flag unpatched installs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.