CVE-2025-0289

HIGH

7.8

Description

Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.

CVE Details

CVSS v3.1 Score7.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published3/3/2025

Last Modified6/25/2025

Sourcenvd

Honeypot Sightings0

Affected Products

paragon-software:paragon_backup_\&_recoveryparagon-software:paragon_disk_wiperparagon-software:paragon_drive_copyparagon-software:paragon_hard_disk_managerparagon-software:paragon_migrate_os_to_ssdparagon-software:paragon_partition_manager

References

https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys(cret@cert.org)

https://www.kb.cert.org/vuls/id/726882(cret@cert.org)

https://www.paragon-software.com/support/#patches(cret@cert.org)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.