ThreatFire System Monitor CVE-2025-61156

Requires ThreatFire System Monitor v4.7.0.53 to be installed with its vulnerable kernel driver loaded, and the attacker must already be an authenticated local user (PR:L) able to open a handle to the driver's device object and issue the insecure IOCTL - there is no remote network vector (AV:L) and no user interaction is needed (UI:N). Exploitation is therefore limited to post-compromise/local scenarios and gated entirely by the rare presence of this discontinued product; it does not affect default configurations of any widely-deployed software.

CVSS 3.1 base score 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local privilege-escalation flaw: an already-authenticated low-privileged user sends an insecure IOCTL to a kernel driver to gain full confidentiality, integrity, and availability impact (i.e., SYSTEM/kernel-level control). This is a classic local LPE profile, not a remotely reachable issue - the AV:L and PR:L metrics mean an attacker must already have code execution as a standard user on the host, which materially lowers urgency compared with a network-exploitable bug. A GitHub repository explicitly named CVE-2025-61156 (D7EAD) indicates that publicly available exploit code exists, which raises practical exploitability for anyone who already has a foothold. No EPSS score was provided in the input and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; EPSS absence means widespread-exploitation probability cannot be quantified from the data given. The dominant mitigating factor is the affected product itself: ThreatFire System Monitor v4.7.0.53 is a long-discontinued behavioral anti-malware tool, so despite the credible POC the real-world attack surface is very small. Net: a legitimately High-severity local EISO (escalation) bug with public POC, but low overall priority outside the rare environments still running this retired software.

An attacker who already has standard-user access to a Windows host running ThreatFire System Monitor v4.7.0.53 opens a handle to the vulnerable kernel driver's device object and issues a crafted, insufficiently-validated IOCTL. Because the driver enforces incorrect access control, the call executes attacker-controlled operations in kernel context, escalating from a limited account to SYSTEM and allowing arbitrary command execution. Public exploit code for this CVE exists (D7EAD GitHub repository), lowering the skill barrier for anyone with a local foothold.