Search criteria
15 vulnerabilities found for paragon_partition_manager by paragon-software
FKIE_CVE-2025-0287
Vulnerability from fkie_nvd - Published: 2025-03-03 17:15 - Updated: 2025-06-25 16:49
Severity ?
Summary
Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:paragon-software:paragon_backup_\\\u0026_recovery:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79494FF3-97A2-4DFA-AFE8-3A4E1C4F2C67",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B71A5C9-A1A5-4965-B430-6401C5D87704",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7AEEBDE5-02CD-469E-84BC-4EADCB3BEFC9",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F70FA517-5000-41D9-BAF4-4853C0C2E2F2",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54699509-C197-4AE6-B1DC-D53365128BD6",
"versionEndIncluding": "5",
"versionStartIncluding": "4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BDBED8CE-A90D-48DC-89F6-CA5EF10DD12C",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation."
},
{
"lang": "es",
"value": "Paragon Partition Manager versi\u00f3n 7.9.1 contiene una vulnerabilidad de desreferencia de puntero nulo dentro de biontdrv.sys que es causada por la falta de una estructura MasterLrp v\u00e1lida en el b\u00fafer de entrada, lo que permite a un atacante ejecutar c\u00f3digo arbitrario en el kernel, facilitando la escalada de privilegios."
}
],
"id": "CVE-2025-0287",
"lastModified": "2025-06-25T16:49:19.670",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.5,
"impactScore": 2.5,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-03-03T17:15:13.710",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Vendor Advisory"
],
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"source": "cret@cert.org",
"tags": [
"Product"
],
"url": "https://www.paragon-software.com/support/#patches"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
FKIE_CVE-2025-0285
Vulnerability from fkie_nvd - Published: 2025-03-03 17:15 - Updated: 2025-06-25 16:49
Severity ?
Summary
Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to perform privilege escalation exploits.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:paragon-software:paragon_backup_\\\u0026_recovery:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79494FF3-97A2-4DFA-AFE8-3A4E1C4F2C67",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B71A5C9-A1A5-4965-B430-6401C5D87704",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7AEEBDE5-02CD-469E-84BC-4EADCB3BEFC9",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F70FA517-5000-41D9-BAF4-4853C0C2E2F2",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54699509-C197-4AE6-B1DC-D53365128BD6",
"versionEndIncluding": "5",
"versionStartIncluding": "4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BDBED8CE-A90D-48DC-89F6-CA5EF10DD12C",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to perform privilege escalation exploits."
},
{
"lang": "es",
"value": "Paragon Partition Manager versi\u00f3n 7.9.1 contiene una vulnerabilidad de mapeo de memoria de kernel arbitraria dentro de biontdrv.sys que es causada por una falla en la validaci\u00f3n adecuada de la longitud de los datos suministrados por el usuario, lo que puede permitir a un atacante realizar ataques de escalada de privilegios."
}
],
"id": "CVE-2025-0285",
"lastModified": "2025-06-25T16:49:13.900",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-03-03T17:15:13.430",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Vendor Advisory"
],
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"source": "cret@cert.org",
"tags": [
"Product"
],
"url": "https://www.paragon-software.com/support/#patches"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1284"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2025-0288
Vulnerability from fkie_nvd - Published: 2025-03-03 17:15 - Updated: 2025-06-25 16:49
Severity ?
Summary
Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:paragon-software:paragon_backup_\\\u0026_recovery:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79494FF3-97A2-4DFA-AFE8-3A4E1C4F2C67",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B71A5C9-A1A5-4965-B430-6401C5D87704",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7AEEBDE5-02CD-469E-84BC-4EADCB3BEFC9",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F70FA517-5000-41D9-BAF4-4853C0C2E2F2",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54699509-C197-4AE6-B1DC-D53365128BD6",
"versionEndIncluding": "5",
"versionStartIncluding": "4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BDBED8CE-A90D-48DC-89F6-CA5EF10DD12C",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation."
},
{
"lang": "es",
"value": "Paragon Partition Manager versi\u00f3n 7.9.1 contiene una vulnerabilidad de memoria de kernel arbitraria facilitada por la funci\u00f3n memmove, que no valida ni depura la entrada controlada por el usuario, lo que permite a un atacante escribir memoria de kernel arbitraria y realizar una escalada de privilegios."
}
],
"id": "CVE-2025-0288",
"lastModified": "2025-06-25T16:49:22.483",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-03-03T17:15:13.823",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Vendor Advisory"
],
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"source": "cret@cert.org",
"tags": [
"Product"
],
"url": "https://www.paragon-software.com/support/#patches"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2025-0286
Vulnerability from fkie_nvd - Published: 2025-03-03 17:15 - Updated: 2025-06-25 16:49
Severity ?
Summary
Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:paragon-software:paragon_backup_\\\u0026_recovery:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79494FF3-97A2-4DFA-AFE8-3A4E1C4F2C67",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B71A5C9-A1A5-4965-B430-6401C5D87704",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7AEEBDE5-02CD-469E-84BC-4EADCB3BEFC9",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F70FA517-5000-41D9-BAF4-4853C0C2E2F2",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54699509-C197-4AE6-B1DC-D53365128BD6",
"versionEndIncluding": "5",
"versionStartIncluding": "4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BDBED8CE-A90D-48DC-89F6-CA5EF10DD12C",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine."
},
{
"lang": "es",
"value": "Paragon Partition Manager versi\u00f3n 7.9.1 contiene una vulnerabilidad de escritura arbitraria en la memoria del kernel dentro de biontdrv.sys que es causada por una falla al validar correctamente la longitud de los datos proporcionados por el usuario, lo que puede permitir que un atacante ejecute c\u00f3digo arbitrario en la m\u00e1quina v\u00edctima."
}
],
"id": "CVE-2025-0286",
"lastModified": "2025-06-25T16:49:16.837",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.5,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-03-03T17:15:13.537",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Vendor Advisory"
],
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"source": "cret@cert.org",
"tags": [
"Product"
],
"url": "https://www.paragon-software.com/support/#patches"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1284"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2025-0289
Vulnerability from fkie_nvd - Published: 2025-03-03 17:15 - Updated: 2025-06-25 16:49
Severity ?
Summary
Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:paragon-software:paragon_backup_\\\u0026_recovery:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79494FF3-97A2-4DFA-AFE8-3A4E1C4F2C67",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B71A5C9-A1A5-4965-B430-6401C5D87704",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7AEEBDE5-02CD-469E-84BC-4EADCB3BEFC9",
"versionEndIncluding": "16",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F70FA517-5000-41D9-BAF4-4853C0C2E2F2",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:*",
"matchCriteriaId": "54699509-C197-4AE6-B1DC-D53365128BD6",
"versionEndIncluding": "5",
"versionStartIncluding": "4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BDBED8CE-A90D-48DC-89F6-CA5EF10DD12C",
"versionEndIncluding": "17.39",
"versionStartIncluding": "15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service."
},
{
"lang": "es",
"value": "La versi\u00f3n 17 de Paragon Partition Manager, tanto la versi\u00f3n comunitaria como la empresarial, contienen una vulnerabilidad de acceso inseguro a los recursos del kernel facilitada por el controlador que no valida el puntero MappedSystemVa antes de pasarlo a HalReturnToFirmware, lo que puede permitir a un atacante comprometer el servicio."
}
],
"id": "CVE-2025-0289",
"lastModified": "2025-06-25T16:49:25.730",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-03-03T17:15:13.943",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Vendor Advisory"
],
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"source": "cret@cert.org",
"tags": [
"Product"
],
"url": "https://www.paragon-software.com/support/#patches"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2025-0285 (GCVE-0-2025-0285)
Vulnerability from cvelistv5 – Published: 2025-03-03 16:25 – Updated: 2025-09-09 13:57
VLAI?
Title
CVE-2025-0285
Summary
Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to perform privilege escalation exploits.
Severity ?
7.8 (High)
CWE
- CWE-1287 - Improper Validation of Specified Type of Input
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Migrate OS to SSD |
Affected:
4 , ≤ 5
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0285",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-04T15:15:31.228642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T13:57:18.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Paragon Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to perform privilege escalation exploits."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1287: Improper Validation of Specified Type of Input",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:07:05.461Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0285",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0285"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0285",
"datePublished": "2025-03-03T16:25:38.704Z",
"dateReserved": "2025-01-06T19:14:34.676Z",
"dateUpdated": "2025-09-09T13:57:18.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0286 (GCVE-0-2025-0286)
Vulnerability from cvelistv5 – Published: 2025-03-03 16:25 – Updated: 2025-09-09 13:59
VLAI?
Title
CVE-2025-0286
Summary
Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine.
Severity ?
8.4 (High)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Partition Manager |
Affected:
15 , ≤ 17.39
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-04T15:17:36.923218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T13:59:49.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-787 Out-of-bounds Write",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:07:38.613Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0286",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0286"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0286",
"datePublished": "2025-03-03T16:25:25.767Z",
"dateReserved": "2025-01-06T19:14:51.646Z",
"dateUpdated": "2025-09-09T13:59:49.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0287 (GCVE-0-2025-0287)
Vulnerability from cvelistv5 – Published: 2025-03-03 16:25 – Updated: 2025-09-05 12:08
VLAI?
Title
CVE-2025-0287
Summary
Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation.
Severity ?
5.1 (Medium)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Migrate OS to SSD |
Affected:
4 , ≤ 5
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0287",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-03T19:22:13.884895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-03T19:30:13.214Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:08:03.175Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0287",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0287"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0287",
"datePublished": "2025-03-03T16:25:08.481Z",
"dateReserved": "2025-01-06T19:15:09.799Z",
"dateUpdated": "2025-09-05T12:08:03.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0288 (GCVE-0-2025-0288)
Vulnerability from cvelistv5 – Published: 2025-03-03 16:24 – Updated: 2025-09-09 14:00
VLAI?
Title
CVE-2025-0288
Summary
Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.
Severity ?
7.8 (High)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Migrate OS to SSD |
Affected:
4 , ≤ 5
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-04T15:19:14.562640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T14:00:21.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-131 Incorrect Calculation of Buffer Size",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:08:49.317Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0288",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0288"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0288",
"datePublished": "2025-03-03T16:24:54.853Z",
"dateReserved": "2025-01-06T19:15:19.554Z",
"dateUpdated": "2025-09-09T14:00:21.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0289 (GCVE-0-2025-0289)
Vulnerability from cvelistv5 – Published: 2025-03-03 16:24 – Updated: 2025-09-09 14:03
VLAI?
Title
CVE-2025-0289
Summary
Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.
Severity ?
7.8 (High)
CWE
- CWE-1287 - Improper Validation of Specified Type of Input
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Migrate OS to SSD |
Affected:
4 , ≤ 5
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-04T15:21:49.572240Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T14:03:26.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1287: Improper Validation of Specified Type of Input",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:08:26.359Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0289",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0289"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0289",
"datePublished": "2025-03-03T16:24:38.134Z",
"dateReserved": "2025-01-06T19:15:26.403Z",
"dateUpdated": "2025-09-09T14:03:26.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0285 (GCVE-0-2025-0285)
Vulnerability from nvd – Published: 2025-03-03 16:25 – Updated: 2025-09-09 13:57
VLAI?
Title
CVE-2025-0285
Summary
Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to perform privilege escalation exploits.
Severity ?
7.8 (High)
CWE
- CWE-1287 - Improper Validation of Specified Type of Input
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Migrate OS to SSD |
Affected:
4 , ≤ 5
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0285",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-04T15:15:31.228642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T13:57:18.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Paragon Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to perform privilege escalation exploits."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1287: Improper Validation of Specified Type of Input",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:07:05.461Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0285",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0285"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0285",
"datePublished": "2025-03-03T16:25:38.704Z",
"dateReserved": "2025-01-06T19:14:34.676Z",
"dateUpdated": "2025-09-09T13:57:18.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0286 (GCVE-0-2025-0286)
Vulnerability from nvd – Published: 2025-03-03 16:25 – Updated: 2025-09-09 13:59
VLAI?
Title
CVE-2025-0286
Summary
Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine.
Severity ?
8.4 (High)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Partition Manager |
Affected:
15 , ≤ 17.39
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-04T15:17:36.923218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T13:59:49.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-787 Out-of-bounds Write",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:07:38.613Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0286",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0286"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0286",
"datePublished": "2025-03-03T16:25:25.767Z",
"dateReserved": "2025-01-06T19:14:51.646Z",
"dateUpdated": "2025-09-09T13:59:49.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0287 (GCVE-0-2025-0287)
Vulnerability from nvd – Published: 2025-03-03 16:25 – Updated: 2025-09-05 12:08
VLAI?
Title
CVE-2025-0287
Summary
Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation.
Severity ?
5.1 (Medium)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Migrate OS to SSD |
Affected:
4 , ≤ 5
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0287",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-03T19:22:13.884895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-03T19:30:13.214Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:08:03.175Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0287",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0287"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0287",
"datePublished": "2025-03-03T16:25:08.481Z",
"dateReserved": "2025-01-06T19:15:09.799Z",
"dateUpdated": "2025-09-05T12:08:03.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0288 (GCVE-0-2025-0288)
Vulnerability from nvd – Published: 2025-03-03 16:24 – Updated: 2025-09-09 14:00
VLAI?
Title
CVE-2025-0288
Summary
Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.
Severity ?
7.8 (High)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Migrate OS to SSD |
Affected:
4 , ≤ 5
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-04T15:19:14.562640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T14:00:21.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-131 Incorrect Calculation of Buffer Size",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:08:49.317Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0288",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0288"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0288",
"datePublished": "2025-03-03T16:24:54.853Z",
"dateReserved": "2025-01-06T19:15:19.554Z",
"dateUpdated": "2025-09-09T14:00:21.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0289 (GCVE-0-2025-0289)
Vulnerability from nvd – Published: 2025-03-03 16:24 – Updated: 2025-09-09 14:03
VLAI?
Title
CVE-2025-0289
Summary
Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.
Severity ?
7.8 (High)
CWE
- CWE-1287 - Improper Validation of Specified Type of Input
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Paragon Software | Migrate OS to SSD |
Affected:
4 , ≤ 5
(custom)
|
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-0289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-04T15:21:49.572240Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T14:03:26.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Migrate OS to SSD",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "5",
"status": "affected",
"version": "4",
"versionType": "custom"
}
]
},
{
"product": "Disk Wiper",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Drive Copy",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "16",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Hard Disk Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Backup and Recovery",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
},
{
"product": "Partition Manager",
"vendor": "Paragon Software",
"versions": [
{
"lessThanOrEqual": "17.39",
"status": "affected",
"version": "15",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-1287: Improper Validation of Specified Type of Input",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-05T12:08:26.359Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
},
{
"url": "https://www.kb.cert.org/vuls/id/726882"
},
{
"url": "https://www.paragon-software.com/support/#patches"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2025-0289",
"x_generator": {
"engine": "VINCE 3.0.24",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0289"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2025-0289",
"datePublished": "2025-03-03T16:24:38.134Z",
"dateReserved": "2025-01-06T19:15:26.403Z",
"dateUpdated": "2025-09-09T14:03:26.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}