CVE-2025-0289

Published: Mar 3, 2025Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.

Affected (6)

Products: Paragon Software: Paragon Backup & Recovery, Paragon Disk Wiper, Paragon Drive Copy, Paragon Hard Disk Manager, Paragon Migrate Os To Ssd, Paragon Partition Manager

Paragon Software

6 products

Paragon Backup & Recovery

Paragon Disk Wiper

Paragon Drive Copy

Paragon Hard Disk Manager

Paragon Migrate Os To Ssd

Paragon Partition Manager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Paragon Software Paragon Backup & Recovery	15 ≤ version ≤ 17.39
Paragon Software Paragon Disk Wiper	15 ≤ version ≤ 16
Paragon Software Paragon Drive Copy	15 ≤ version ≤ 16
Paragon Software Paragon Hard Disk Manager	15 ≤ version ≤ 17.39
Paragon Software Paragon Migrate Os To Ssd	4 ≤ version ≤ 5
Paragon Software Paragon Partition Manager	15 ≤ version ≤ 17.39

References (3)

https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys

Source: cret@cert.org

Vendor Advisory

https://www.kb.cert.org/vuls/id/726882

Source: cret@cert.org

Third Party Advisory

https://www.paragon-software.com/support/#patches

Source: cret@cert.org

Product

Timeline

No history available yet.