Advantech SUSI
CVE-2025-14252
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local foothold
-
DeliveryOpen handle to susi.sys device
-
ExploitIssue crafted IOCTL for arbitrary kernel R/W
-
ExecutionOverwrite token/MSR to escalate
-
ImpactExecute code as SYSTEM/kernel
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access as a low-privileged user on a system where the Advantech SUSI driver (susi.sys, version 5.0.24335 or prior) is installed and loaded - this driver is typically present on Advantech industrial/embedded PCs or any Windows host running the SUSI software. The driver's IOCTL interface improperly permits unprivileged callers to perform arbitrary memory, I/O port, and MSR reads/writes. Limiting factors: no remote network vector (local only), the SUSI driver must actually be installed/loaded, and the attacker must already be able to run code locally; however, no user interaction and only low (not admin) privileges are needed. Because susi.sys is a signed third-party driver, it is additionally exposable via BYOVD on hosts where it is not natively installed. |
| Impact | This is a genuine privilege-escalation risk but not an emergency by widespread-exploitation standards. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.5 High) describes a local, low-complexity flaw requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact on the host - consistent with a vulnerable kernel driver (susi.sys) that exposes arbitrary memory/IO/MSR read-write to unprivileged callers (CWE-269). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or probable widespread exploitation; this is currently a no-public-exploit-identified issue. The real priority driver is the vulnerability class: signed vulnerable drivers of this type are attractive for local escalation and for Bring-Your-Own-Vulnerable-Driver (BYOVD) abuse, where an attacker loads the signed driver onto an otherwise-unaffected Windows host to gain kernel access. Caveat: KEV/EPSS/POC data is absent rather than confirmed negative - absence is not proof of safety, and the single vendor reference limits independent corroboration. |
| Exploit ScenarioDerived | A low-privileged attacker who already has code execution on a Windows machine running Advantech SUSI (e.g., an Advantech industrial PC or any host where the SUSI software/driver is installed) opens a handle to the susi.sys device and issues crafted IOCTLs to read and write arbitrary kernel memory, I/O ports, and MSRs, elevating to SYSTEM/kernel. No public exploit code was identified in the provided data, but the capability (arbitrary kernel R/W) makes weaponization straightforward and also enables BYOVD-style abuse on other systems. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Local privilege escalation in the Advantech SUSI Windows kernel driver (susi.sys) 5.0.24335 and prior allows an authenticated low-privileged user to read and write arbitrary memory, I/O ports, and model-specific registers (MSRs), which can be leveraged to escalate to SYSTEM, execute arbitrary code in kernel context, or disclose sensitive information. Exploitation requires local code execution on a host where the driver is installed and loaded - typical of Advantech industrial/embedded PCs or any Windows system running the SUSI software - with no user interaction and no remote network vector; authentication requirements are confirmed as low-privileged (CVSS PR:L). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is real but not indicative of an emergency; note that because susi.sys is a signed third-party driver, it is additionally exposable to bring-your-own-vulnerable-driver (BYOVD) abuse on hosts where SUSI is not natively installed.
RemediationAI
No vendor-released patch has been identified at time of analysis, and no fixed version string is available in the supplied data, so remediation must start with confirming exposure: inventory Windows hosts for susi.sys and the Advantech SUSI package version, and check the TXOne advisory at https://www.txone.com/psirt/advisories/CVE-2025-14252 plus Advantech's support channel for an updated driver or updated SUSI release before assuming a fix exists. Where SUSI functionality is not required, uninstall the SUSI software and remove or rename susi.sys - this fully removes the attack surface but disables hardware monitoring, watchdog, GPIO/SMBus and related board features; on hosts that do need these features, restrict the driver's exposure by ensuring only administrators can load it, enforcing Memory Integrity/HVCI and Microsoft's vulnerable driver blocklist so the known-bad signed binary cannot be loaded via BYOVD, and applying Windows Defender Application Control or AppLocker policies that block the specific driver hash. Additional compensating controls include limiting interactive local logon to trusted users (since the vector is local and low-privileged), monitoring driver load events such as Sysmon Event ID 6 and kernel service installation (Event ID 7045) for unexpected susi.sys loads, and restricting write access to the driver file so it cannot be replaced. Each mitigation has trade-offs: HVCI and driver blocklisting can break other legacy signed drivers, and disabling susi.sys will break SUSI-dependent telemetry and control functions on Advantech industrial systems, so schedule changes with the affected operations team.
Affected ProductsAI
Advantech SUSI version 5.0.24335 and all prior versions are affected, specifically the susi.sys kernel-mode driver distributed with that software; no CPE identifiers were provided in the supplied intelligence, so scoping must be done by installed software/driver version rather than by CPE matching. Exposure is not limited to a single SKU: the driver is shipped with Advantech SUSI on Advantech industrial and embedded PC platforms and can be present on any Windows host where the SUSI package has been installed, and its signed binary is additionally loadable elsewhere via BYOVD. The single reference supplied is the advisory at https://www.txone.com/psirt/advisories/CVE-2025-14252, which should be consulted for the vendor's affected-product list and any updates; no separate Advantech product bulletin or CPE data was included in the input.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Advantech SUSI (Software Utility and Support Interface) package ships a signed kernel-mode Windows driver, susi.sys, used to expose hardware-monitoring and I/O functions (SMBus/I2C, GPIO, watchdog, fan/voltage/temperature sensors) to user-mode utilities on Advantech industrial and embedded motherboards. The vulnerability is classified under CWE-269 (Improper Privilege Management) and described as improper access control: the driver's IOCTL dispatch path fails to enforce that only privileged callers may invoke the hardware-access primitives it exposes, so any local process - including one running as a standard user, per the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector - can pass requests that the driver translates into arbitrary physical/virtual memory reads and writes, x86 I/O port operations, and RDMSR/WRMSR access. Direct MSR and physical-memory writes give an attacker the classic kernel exploit primitives needed to disable or patch security checks (for example, zeroing token privileges, manipulating kernel structures, or overwriting code in writable kernel memory) and thereby obtain SYSTEM-level execution, while the read side yields kernel memory and hardware-state disclosure. Because the flaw is a missing authorization check in a legitimate, signed driver rather than a memory-safety bug, it is also an attractive BYOVD payload: an attacker who already has local administrator rights on a machine without SUSI installed could drop the signed vulnerable binary and load it to bypass kernel driver signing protections and tamper with the kernel.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local IOCTL interface reachable by a low-privileged user gives AV:L/AC:L/PR:L/UI:N; arbitrary kernel memory/IO/MSR R/W yields C:H/I:H/A:H with scope unchanged (S:U) on the host.
Primary rating from Vendor (3ad20294-822c-4ebc-9301-f9a7cf62d46e).
CVSS VectorVendor: 3ad20294-822c-4ebc-9301-f9a7cf62d46e
DescriptionCVE.org
An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in privilege escalation, arbitrary code execution, and information disclosure. This issue affects Advantech SUSI: 5.0.24335 and prior.
Executive ViewAI
Advantech's SUSI Windows kernel driver (susi.sys) version 5.0.24335 and prior contains a high-severity local privilege escalation flaw affecting Windows systems where the driver is installed and loaded, particularly Advantech industrial/embedded PCs and other endpoints running SUSI software. An authenticated low-privileged local user can exploit the driver to gain SYSTEM-level kernel access, which could allow device compromise, sensitive data disclosure, or persistence in operational environments. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis make this a material risk for leadership to track and mitigate.
No vendor-released patch identified at time of analysis; interim mitigations include removing or disabling susi.sys where non-essential, restricting local interactive logon and admin rights, enforcing WDAC/driver blocklists, monitoring for unauthorized driver loads and BYOVD activity with EDR, segmenting affected industrial/embedded systems, and applying least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
GitHub PoC
Exploit-DB