CVE-2025-0289

Published: Mar 3, 2025Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.

Affected (6)

Products: Paragon Software: Paragon Backup & Recovery, Paragon Disk Wiper, Paragon Drive Copy, Paragon Hard Disk Manager, Paragon Migrate Os To Ssd, Paragon Partition Manager

Paragon Software

6 products

Paragon Backup & Recovery

Paragon Disk Wiper

Paragon Drive Copy

Paragon Hard Disk Manager

Paragon Migrate Os To Ssd

Paragon Partition Manager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Paragon Software Paragon Backup & Recovery	From 15 to 17.39
Paragon Software Paragon Disk Wiper	From 15 to 16
Paragon Software Paragon Drive Copy	From 15 to 16
Paragon Software Paragon Hard Disk Manager	From 15 to 17.39
Paragon Software Paragon Migrate Os To Ssd	From 4 to 5
Paragon Software Paragon Partition Manager	From 15 to 17.39

References (3)

https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys

Source: cret@cert.org

Vendor Advisory

https://www.kb.cert.org/vuls/id/726882

Source: cret@cert.org

Third Party Advisory

https://www.paragon-software.com/support/#patches

Source: cret@cert.org

Product

Timeline

No history available yet.