Cyber Posture

CVE-2025-0285

High

Published: 03 March 2025

Published
03 March 2025
Modified
25 June 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2025-0285 is an arbitrary kernel memory mapping vulnerability in the biontdrv.sys driver, affecting various Paragon Software products, including those in the Hard Disk Manager product line. The flaw arises from a failure to properly validate the length of user-supplied data (CWE-1284), enabling potential privilege escalation exploits. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability by supplying malformed data to the driver, allowing arbitrary kernel memory mapping. Successful exploitation leads to privilege escalation, providing high impacts on confidentiality, integrity, and availability.

Paragon Software has issued a security patch for biontdrv.sys across all Hard Disk Manager products, as outlined in their advisory. Further details on mitigation are available from CERT/CC (VU#726882) and Paragon's support patches page, recommending immediate application of the update to affected systems.

Details

CWE(s)
CWE-1284

Affected Products

paragon-software
paragon backup \& recovery
15 — 17.39
paragon-software
paragon disk wiper
15 — 16
paragon-software
paragon drive copy
15 — 16
paragon-software
paragon hard disk manager
15 — 17.39
paragon-software
paragon migrate os to ssd
4 — 5
paragon-software
paragon partition manager
15 — 17.39

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The vulnerability is a local kernel driver flaw enabling arbitrary kernel memory mapping for privilege escalation from low-privileged user context.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References