CVEvulnerability
CVE-2025-0289
7.8 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2025-03-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.
Affected configurations
• paragon-software paragon backup \& recovery (>= 15 <= 17.39)
• paragon-software paragon disk wiper (>= 15 <= 16)
• paragon-software paragon drive copy (>= 15 <= 16)
• paragon-software paragon hard disk manager (>= 15 <= 17.39)
• paragon-software paragon migrate os to ssd (>= 4 <= 5)
• paragon-software paragon partition manager (>= 15 <= 17.39)
References
- https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys Vendor Advisory
- https://www.kb.cert.org/vuls/id/726882 Third Party Advisory
- https://www.paragon-software.com/support/#patches Product