CVE-2025-70795

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-70795", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-17T14:58:56.485Z", "dateReserved": "2026-01-09T00:00:00.000Z", "datePublished": "2026-04-17T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-17T13:58:03.032Z"}, "descriptions": [{"lang": "en", "value": "STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications. Unauthorized processes load the driver and send a crafted IOCTL request (0xB822200C) to terminate processes protected by a third-party implementation. This action exploits insufficient caller validation in the driver's IOCTL handler, allowing unauthorized processes to perform termination operations in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://bbs.kafan.cn/thread-2287429-1-1.html"}, {"url": "https://bbs.kafan.cn/thread-2287429-2-1.html"}, {"url": "https://www.virustotal.com/gui/file/70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b"}, {"url": "https://www.virustotal.com/gui/file/9ace6a1e4bee5834be38b4c2fd26780d1fcc18ea9d58224e31d6382c19e53296"}, {"url": "https://www.virustotal.com/gui/file/fc3588482f596a067b65d5d64d21fe62463b38a138fc87d8d2350efa86d34284"}, {"url": "https://github.com/magicsword-io/LOLDrivers/commit/eea8326bf891d810902203e9ac5cfdeaf5a17a1c"}, {"url": "https://github.com/magicsword-io/LOLDrivers/issues/268"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T14:58:22.947237Z", "id": "CVE-2025-70795", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T14:58:56.485Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-70795", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T14:58:22.947237Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T14:56:15.535Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://bbs.kafan.cn/thread-2287429-1-1.html"}, {"url": "https://bbs.kafan.cn/thread-2287429-2-1.html"}, {"url": "https://www.virustotal.com/gui/file/70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b"}, {"url": "https://www.virustotal.com/gui/file/9ace6a1e4bee5834be38b4c2fd26780d1fcc18ea9d58224e31d6382c19e53296"}, {"url": "https://www.virustotal.com/gui/file/fc3588482f596a067b65d5d64d21fe62463b38a138fc87d8d2350efa86d34284"}, {"url": "https://github.com/magicsword-io/LOLDrivers/commit/eea8326bf891d810902203e9ac5cfdeaf5a17a1c"}, {"url": "https://github.com/magicsword-io/LOLDrivers/issues/268"}], "descriptions": [{"lang": "en", "value": "STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications. Unauthorized processes load the driver and send a crafted IOCTL request (0xB822200C) to terminate processes protected by a third-party implementation. This action exploits insufficient caller validation in the driver's IOCTL handler, allowing unauthorized processes to perform termination operations in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-17T13:58:03.032Z"}}}, "cveMetadata": {"cveId": "CVE-2025-70795", "state": "PUBLISHED", "dateUpdated": "2026-04-17T14:58:56.485Z", "dateReserved": "2026-01-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-17T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications. Unauthorized processes load the driver and send a crafted IOCTL request (0xB822200C) to terminate processes protected by a third-party implementation. This action exploits insufficient caller validation in the driver's IOCTL handler, allowing unauthorized processes to perform termination operations in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications."}, {"lang": "es", "value": "STProcessMonitor 11.11.4.0, parte de la suite de aplicaciones Safetica, permite a un usuario con privilegios de administrador enviar solicitudes IOCTL manipuladas para terminar procesos que est\u00e1n protegidos mediante una implementaci\u00f3n de terceros. Esto es causado por una validaci\u00f3n insuficiente del llamador en el gestor IOCTL del controlador, lo que permite a procesos no autorizados realizar esas acciones en el espacio del kernel. La explotaci\u00f3n exitosa puede llevar a una denegaci\u00f3n de servicio al interrumpir servicios o aplicaciones cr\u00edticos de terceros. Procesos no autorizados cargan el controlador y env\u00edan una solicitud IOCTL manipulada (0xB822200C) para terminar procesos protegidos por una implementaci\u00f3n de terceros. Esta acci\u00f3n explota la validaci\u00f3n insuficiente del llamador en el gestor IOCTL del controlador, permitiendo a procesos no autorizados realizar operaciones de terminaci\u00f3n en el espacio del kernel. La explotaci\u00f3n exitosa puede llevar a una denegaci\u00f3n de servicio al interrumpir servicios o aplicaciones cr\u00edticos de terceros."}], "id": "CVE-2025-70795", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70795", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T14:58:22.947237Z", "version": "2.0.3"}}]}, "published": "2026-04-17T14:16:33.373", "references": [{"source": "cve@mitre.org", "url": "https://bbs.kafan.cn/thread-2287429-1-1.html"}, {"source": "cve@mitre.org", "url": "https://bbs.kafan.cn/thread-2287429-2-1.html"}, {"source": "cve@mitre.org", "url": "https://github.com/magicsword-io/LOLDrivers/commit/eea8326bf891d810902203e9ac5cfdeaf5a17a1c"}, {"source": "cve@mitre.org", "url": "https://github.com/magicsword-io/LOLDrivers/issues/268"}, {"source": "cve@mitre.org", "url": "https://www.virustotal.com/gui/file/70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b"}, {"source": "cve@mitre.org", "url": "https://www.virustotal.com/gui/file/9ace6a1e4bee5834be38b4c2fd26780d1fcc18ea9d58224e31d6382c19e53296"}, {"source": "cve@mitre.org", "url": "https://www.virustotal.com/gui/file/fc3588482f596a067b65d5d64d21fe62463b38a138fc87d8d2350efa86d34284"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.11.4.0,11.11.4.0]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "stprocessmonitor", "vendor": "safetica"}], "analysis": {"en": {"generated_at": "2026-04-18T17:15:07.812859+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011issued patch or upgrade to a later version of STProcessMonitor that removes the unvalidated IOCTL handler.", "If a patch is unavailable, prevent non\u2011privileged or untrusted processes from loading the driver by disabling generic driver load mechanisms or re\u2011firmware signing checks.", "Configure the operating system to enforce strict IOCTL access control, allowing only privileged or authenticated callers to send the termination command.", "Set up kernel\u2011level monitoring or logging for attempts to invoke the 0xB822200C IOCTL to detect malicious activity.", "Re\u2011evaluate the need for third\u2011party protection mechanisms and consider isolating critical services so that driver\u2011level process termination cannot bring them down."], "summary": {"action": "Patch Now", "impact": "Denial of Service via kernel\u2011space process termination"}, "threat_synthesis": {"affected_systems": "The impacted product is STProcessMonitor version 11.11.4.0, part of the Safetica Application suite. No other vendor or product information is listed. The flaw exists in the driver that ships with this specific release.", "description_and_impact": "This flaw is a kernel driver oversight that allows contextless IOCTL invocations to terminate processes that otherwise rely on third\u2011party protection mechanisms. Because the driver accepts requests without ensuring the caller possesses the required privileges, any process that can load the driver can instruct the kernel to kill a protected process. The effect is a denial of service for the protected processes or applications, potentially crippling critical services. This vulnerability aligns with the CWE\u2011269 pattern of insufficient caller validation in kernel code.", "risk_and_exploitability": "The vulnerability can be leveraged by any entity capable of loading the vulnerable driver, which may be achieved by an attacker who has local code execution or can elevate to a privileged account. Once the driver is loaded, the crafted IOCTL (0xB822200C) simply instructs the kernel to terminate a protected target, requiring no further authentication. The CVSS score is 5.5, indicating moderate severity, while EPSS data is not available, and the flaw is not listed in CISA's KEV catalog, so the exact exploitation likelihood is unknown. However, the low barrier to exploitation coupled with the severe availability impact yields a high risk for systems that rely on the affected driver."}}}}, "created": "2026-04-17T20:40:18.700525+00:00", "title": "Kernel\u2011Space Process Termination via Unsanitized IOCTL in Safetica STProcessMonitor", "updated": "2026-04-18T17:30:05.939411+00:00", "vendors": ["safetica", "safetica$PRODUCT$stprocessmonitor"]}