CVE-2025-0834

CVE-2025-0834 is a privilege escalation vulnerability in Wondershare Dr.Fone version 13.5.21, published on 2025-01-30. The flaw, tied to CWE-269 (Improper Privilege Management), enables an attacker to replace the binary at C:\ProgramData\Wondershare\wsServices\ElevationService.exe with a malicious version. This binary is automatically executed with SYSTEM privileges, allowing unauthorized elevation. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity and no user interaction required. By overwriting the ElevationService.exe binary in the ProgramData directory, the attacker tricks the software into running their malicious code as SYSTEM. This achieves high impacts on confidentiality, integrity, and availability, potentially granting full administrative control over the affected system.

For mitigation guidance, refer to the INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/wondershare-drfone-privilege-scalation-vulnerability.