CVE-2025-0289

State: Published
Severity: 7.8 High
Published: Mar 3, 2025
Updated: Sep 9, 2025
Reserved: Jan 6, 2025

Description

Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Migrate OS to SSDParagon Software	4 through 5Affected
Disk WiperParagon Software	15 through 16Affected
Drive CopyParagon Software	15 through 16Affected
Hard Disk ManagerParagon Software	15 through 17.39Affected
Backup and RecoveryParagon Software	15 through 17.39Affected
Partition ManagerParagon Software	15 through 17.39Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.