CVE-2025-0289: high-severity vulnerability in Paragon Software Backup and Recovery
CVE-2025-0289
Published · Updated
43Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 7.8epss 0.3%
from disclosure to weapon
Published on NVDMar 3
VulnCheckFeb 28
exploitation probability
0.3%top 74% of all CVEs
observed exploitation
yesVulnCheck
Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Paragon Software · Backup and RecoveryParagon Software · Disk WiperParagon Software · Drive CopyParagon Software · Hard Disk ManagerParagon Software · Migrate OS to SSDParagon Software · Partition ManagerRelated CVEs — Paragon Software Backup and Recovery
In the same product, most dangerous first.