CVE-2025-62001

BullWall Ransomware Containment hard-coded folder exclusions

View on CVE.org
Published Dec 18, 2025 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which remove hardcoded exclusion behavior and exposes exclusion handling as configurable settings.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description BullWall Ransomware Containment supports configurable file and directory exclusions such as '$recycle.bin' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker with file-write permissions to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which removes hardcoded exclusion behavior and exposes exclusion handling as configurable settings. BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which remove hardcoded exclusion behavior and exposes exclusion handling as configurable settings.
Type Values Removed Values Added
Description BullWall Ransomware Containment contains excluded file paths, such as '$recycle.bin' that are not monitored. An attacker with file write permissions could bypass detection by renaming a directory. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 were confirmed to be affected; other versions before and after may also be affected. BullWall Ransomware Containment supports configurable file and directory exclusions such as '$recycle.bin' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker with file-write permissions to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which removes hardcoded exclusion behavior and exposes exclusion handling as configurable settings.
Type Values Removed Values Added
First Time appeared Bullwall
Bullwall ransomware Containment
CPEs cpe:2.3:a:bullwall:ransomware_containment:4.6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:bullwall:ransomware_containment:4.6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:bullwall:ransomware_containment:4.6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:bullwall:ransomware_containment:4.6.1.4:*:*:*:*:*:*:*
Vendors & Products Bullwall
Bullwall ransomware Containment
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description BullWall Ransomware Containment contains excluded file paths, such as '$recycle.bin' that are not monitored. An attacker with file write permissions could bypass detection by renaming a directory. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 were confirmed to be affected; other versions before and after may also be affected.
Title BullWall Ransomware Containment hard-coded folder exclusions
Weaknesses CWE-420
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
cisa-cg
Published
Updated
Jan 15, 2026, 7:51 PM
Reserved
Oct 7, 2025, 2:33 PM

View source JSON

Updated
Jan 8, 2026, 6:14 PM

JSON

Status
Modified
Published
Dec 18, 2025, 9:15 PM
Modified
Jun 17, 2026, 9:51 AM

View source JSON

No data.

No data.