Vulnerability-Lookup

CVE-2025-0289 (GCVE-0-2025-0289)

Vulnerability from cvelistv5 – Published: 2025-03-03 16:24 – Updated: 2025-09-09 14:03

Title

CVE-2025-0289

Summary

Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-04 15:21 UTC

CWE

CWE-1287 - Improper Validation of Specified Type of Input

Assigner

certcc mitre root

References

3 references

URL	Tags
https://paragon-software.zendesk.com/hc/en-us/art…
https://www.kb.cert.org/vuls/id/726882
https://www.paragon-software.com/support/#patches

Impacted products

6 products

Vendor	Product	Version	CPE status
Paragon Software	Migrate OS to SSD	Affected: 4 , ≤ 5 (custom)	guessed
Paragon Software	Disk Wiper	Affected: 15 , ≤ 16 (custom)	guessed
Paragon Software	Drive Copy	Affected: 15 , ≤ 16 (custom)	guessed
Paragon Software	Hard Disk Manager	Affected: 15 , ≤ 17.39 (custom)	guessed
Paragon Software	Backup and Recovery	Affected: 15 , ≤ 17.39 (custom)	guessed
Paragon Software	Partition Manager	Affected: 15 , ≤ 17.39 (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-0289",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T15:21:49.572240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-09T14:03:26.472Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Migrate OS to SSD",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "5",
              "status": "affected",
              "version": "4",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Disk Wiper",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "16",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Drive Copy",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "16",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Hard Disk Manager",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "17.39",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Backup and Recovery",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "17.39",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Partition Manager",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "17.39",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1287: Improper Validation of Specified Type of Input",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-05T12:08:26.359Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
        },
        {
          "url": "https://www.kb.cert.org/vuls/id/726882"
        },
        {
          "url": "https://www.paragon-software.com/support/#patches"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-0289",
      "x_generator": {
        "engine": "VINCE 3.0.24",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0289"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2025-0289",
    "datePublished": "2025-03-03T16:24:38.134Z",
    "dateReserved": "2025-01-06T19:15:26.403Z",
    "dateUpdated": "2025-09-09T14:03:26.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-0289",
      "date": "2026-09-20",
      "epss": "0.00329",
      "percentile": "0.26266"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Migrate OS to SSD",
                "vendor": "Paragon Software",
                "versions": [
                  {
                    "lessThanOrEqual": "5",
                    "status": "affected",
                    "version": "4",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Disk Wiper",
                "vendor": "Paragon Software",
                "versions": [
                  {
                    "lessThanOrEqual": "16",
                    "status": "affected",
                    "version": "15",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Drive Copy",
                "vendor": "Paragon Software",
                "versions": [
                  {
                    "lessThanOrEqual": "16",
                    "status": "affected",
                    "version": "15",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Hard Disk Manager",
                "vendor": "Paragon Software",
                "versions": [
                  {
                    "lessThanOrEqual": "17.39",
                    "status": "affected",
                    "version": "15",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Backup and Recovery",
                "vendor": "Paragon Software",
                "versions": [
                  {
                    "lessThanOrEqual": "17.39",
                    "status": "affected",
                    "version": "15",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Partition Manager",
                "vendor": "Paragon Software",
                "versions": [
                  {
                    "lessThanOrEqual": "17.39",
                    "status": "affected",
                    "version": "15",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "cret@cert.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:paragon-software:paragon_backup_\\\u0026_recovery:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "79494FF3-97A2-4DFA-AFE8-3A4E1C4F2C67",
                    "versionEndIncluding": "17.39",
                    "versionStartIncluding": "15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2B71A5C9-A1A5-4965-B430-6401C5D87704",
                    "versionEndIncluding": "16",
                    "versionStartIncluding": "15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7AEEBDE5-02CD-469E-84BC-4EADCB3BEFC9",
                    "versionEndIncluding": "16",
                    "versionStartIncluding": "15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F70FA517-5000-41D9-BAF4-4853C0C2E2F2",
                    "versionEndIncluding": "17.39",
                    "versionStartIncluding": "15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "54699509-C197-4AE6-B1DC-D53365128BD6",
                    "versionEndIncluding": "5",
                    "versionStartIncluding": "4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BDBED8CE-A90D-48DC-89F6-CA5EF10DD12C",
                    "versionEndIncluding": "17.39",
                    "versionStartIncluding": "15",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service."
          },
          {
            "lang": "es",
            "value": "La versi\u00f3n 17 de Paragon Partition Manager, tanto la versi\u00f3n comunitaria como la empresarial, contienen una vulnerabilidad de acceso inseguro a los recursos del kernel facilitada por el controlador que no valida el puntero MappedSystemVa antes de pasarlo a HalReturnToFirmware, lo que puede permitir a un atacante comprometer el servicio."
          }
        ],
        "id": "CVE-2025-0289",
        "lastModified": "2026-06-17T08:26:13.337",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-0289",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T15:21:49.572240Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-03-03T17:15:13.943",
        "references": [
          {
            "source": "cret@cert.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
          },
          {
            "source": "cret@cert.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.kb.cert.org/vuls/id/726882"
          },
          {
            "source": "cret@cert.org",
            "tags": [
              "Product"
            ],
            "url": "https://www.paragon-software.com/support/#patches"
          }
        ],
        "sourceIdentifier": "cret@cert.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T17:29:30+00:00",
      "cve": "CVE-2025-0289",
      "id": "CVE-2025-0289",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2025-0289",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-0289.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-0289",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-04T15:21:49.572240Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-04T15:22:18.527Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Migrate OS to SSD",
              "vendor": "Paragon Software",
              "versions": [
                {
                  "lessThanOrEqual": "5",
                  "status": "affected",
                  "version": "4",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "Disk Wiper",
              "vendor": "Paragon Software",
              "versions": [
                {
                  "lessThanOrEqual": "16",
                  "status": "affected",
                  "version": "15",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "Drive Copy",
              "vendor": "Paragon Software",
              "versions": [
                {
                  "lessThanOrEqual": "16",
                  "status": "affected",
                  "version": "15",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "Hard Disk Manager",
              "vendor": "Paragon Software",
              "versions": [
                {
                  "lessThanOrEqual": "17.39",
                  "status": "affected",
                  "version": "15",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "Backup and Recovery",
              "vendor": "Paragon Software",
              "versions": [
                {
                  "lessThanOrEqual": "17.39",
                  "status": "affected",
                  "version": "15",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "Partition Manager",
              "vendor": "Paragon Software",
              "versions": [
                {
                  "lessThanOrEqual": "17.39",
                  "status": "affected",
                  "version": "15",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-1287: Improper Validation of Specified Type of Input",
                  "lang": "en"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-09-05T12:08:26.359Z",
            "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
            "shortName": "certcc"
          },
          "references": [
            {
              "url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
            },
            {
              "url": "https://www.kb.cert.org/vuls/id/726882"
            },
            {
              "url": "https://www.paragon-software.com/support/#patches"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "CVE-2025-0289",
          "x_generator": {
            "engine": "VINCE 3.0.24",
            "env": "prod",
            "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-0289"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "assignerShortName": "certcc",
        "cveId": "CVE-2025-0289",
        "datePublished": "2025-03-03T16:24:38.134Z",
        "dateReserved": "2025-01-06T19:15:26.403Z",
        "dateUpdated": "2025-09-09T14:03:26.472Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2025-02229 (CVE-2025-0289)

Vulnerability from fstec – Published: 2025-03-04 – Updated: 2025-03-04 – View on bdu.fstec.ru Fixed

Title

Уязвимость драйвера BioNTdrv.sys программного обеспечения для работы с разделами жестких дисков Paragon Partition Manager, позволяющая нарушителю повысить свои привилегии до уровня system

Summary

Уязвимость драйвера BioNTdrv.sys программного обеспечения для работы с разделами жестких дисков Paragon Partition Manager связана с ошибками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии до уровня system

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

7.8 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 (High) CVSS 4.0


                      
                        CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Authorization bypass

Incidents

Being clarified

Remediation

Software update

CWE

CWE-284 - Неправильный контроль доступа

Aliases

CVE-2025-0289

References

3 references

URL
https://www.cybersecurity-help.cz/vdb/SB2025022879
https://www.kb.cert.org/vuls/id/726882
https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT…

Impacted products

2 products from 1 vendor

Vendors

Paragon Software Group

Products

BioNTdrv.sys, Paragon Partition Manager

Versions

до 2.0.0 (BioNTdrv.sys), 17.0.0 (Paragon Partition Manager)

Product types

Микропрограммный код аппаратных компонентов компьютера, Application software

Platforms

Microsoft Corp Windows -

Mitigations

Использование рекомендаций: https://www.kb.cert.org/vuls/id/726882

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": "AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber",
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Paragon Software Group",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 2.0.0 (BioNTdrv.sys), 17.0.0 (Paragon Partition Manager)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://www.kb.cert.org/vuls/id/726882",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "28.02.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "04.03.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "04.03.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-02229",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-0289",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "BioNTdrv.sys, Paragon Partition Manager",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Microsoft Corp Windows - ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 BioNTdrv.sys \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u043c\u0438 \u0436\u0435\u0441\u0442\u043a\u0438\u0445 \u0434\u0438\u0441\u043a\u043e\u0432 Paragon Partition Manager, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f system",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (CWE-284)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 BioNTdrv.sys \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u043c\u0438 \u0436\u0435\u0441\u0442\u043a\u0438\u0445 \u0434\u0438\u0441\u043a\u043e\u0432 Paragon Partition Manager \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0440\u0430\u0437\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f system",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.cybersecurity-help.cz/vdb/SB2025022879\nhttps://www.kb.cert.org/vuls/id/726882\nhttps://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-284",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 4.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,5)"
}

FKIE_CVE-2025-0289

Vulnerability from fkie_nvd - Published: 2025-03-03 17:15 - Updated: 2026-06-17 08:26

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
cret@cert.org	https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys	Vendor Advisory
cret@cert.org	https://www.kb.cert.org/vuls/id/726882	Third Party Advisory
cret@cert.org	https://www.paragon-software.com/support/#patches	Product

Impacted products

Vendor	Product	Version
paragon-software	paragon_backup_\&_recovery	*
paragon-software	paragon_disk_wiper	*
paragon-software	paragon_drive_copy	*
paragon-software	paragon_hard_disk_manager	*
paragon-software	paragon_migrate_os_to_ssd	*
paragon-software	paragon_partition_manager	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Migrate OS to SSD",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "5",
              "status": "affected",
              "version": "4",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Disk Wiper",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "16",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Drive Copy",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "16",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Hard Disk Manager",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "17.39",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Backup and Recovery",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "17.39",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Partition Manager",
          "vendor": "Paragon Software",
          "versions": [
            {
              "lessThanOrEqual": "17.39",
              "status": "affected",
              "version": "15",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cret@cert.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:paragon-software:paragon_backup_\\\u0026_recovery:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "79494FF3-97A2-4DFA-AFE8-3A4E1C4F2C67",
              "versionEndIncluding": "17.39",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B71A5C9-A1A5-4965-B430-6401C5D87704",
              "versionEndIncluding": "16",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7AEEBDE5-02CD-469E-84BC-4EADCB3BEFC9",
              "versionEndIncluding": "16",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F70FA517-5000-41D9-BAF4-4853C0C2E2F2",
              "versionEndIncluding": "17.39",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "54699509-C197-4AE6-B1DC-D53365128BD6",
              "versionEndIncluding": "5",
              "versionStartIncluding": "4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDBED8CE-A90D-48DC-89F6-CA5EF10DD12C",
              "versionEndIncluding": "17.39",
              "versionStartIncluding": "15",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service."
    },
    {
      "lang": "es",
      "value": "La versi\u00f3n 17 de Paragon Partition Manager, tanto la versi\u00f3n comunitaria como la empresarial, contienen una vulnerabilidad de acceso inseguro a los recursos del kernel facilitada por el controlador que no valida el puntero MappedSystemVa antes de pasarlo a HalReturnToFirmware, lo que puede permitir a un atacante comprometer el servicio."
    }
  ],
  "id": "CVE-2025-0289",
  "lastModified": "2026-06-17T08:26:13.337",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-0289",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-04T15:21:49.572240Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-03-03T17:15:13.943",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.kb.cert.org/vuls/id/726882"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Product"
      ],
      "url": "https://www.paragon-software.com/support/#patches"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-7MF9-X65F-JWGF

Vulnerability from github – Published: 2025-03-03 18:31 – Updated: 2025-03-05 15:30

Details

Paragon Partition Manager version 17, both community and Business versions, contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-0289"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-03T17:15:13Z",
    "severity": "HIGH"
  },
  "details": "Paragon Partition Manager version 17, both community and Business versions, contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.",
  "id": "GHSA-7mf9-x65f-jwgf",
  "modified": "2025-03-05T15:30:52Z",
  "published": "2025-03-03T18:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0289"
    },
    {
      "type": "WEB",
      "url": "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/726882"
    },
    {
      "type": "WEB",
      "url": "https://www.paragon-software.com/support/#patches"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-0289 (GCVE-0-2025-0289)

BDU:2025-02229 (CVE-2025-0289)

FKIE_CVE-2025-0289

GHSA-7MF9-X65F-JWGF

Tags

Sightings

Nomenclature

Related by attack behaviour