SevenCs ORCA G2 CVE-2025-64699
HIGHSeverity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with any low-privileged account (PR:L, AV:L); NULL DACL makes access trivial (AC:L); raw disk read/write yields full confidentiality, integrity, and availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw disk operations, which could lead to system disruption (DoS) and exposure of sensitive data, and may facilitate local privilege escalation.
AnalysisAI
Local privilege escalation and unauthorized raw-disk access in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22) arise because the SYSTEM-level regService applies a security descriptor with no explicit DACL to a device object, letting a low-privileged local user open the object and issue raw disk operations that can disrupt the system, expose sensitive data, or elevate privileges. Exploitation is local-only (AV:L, PR:L, UI:N, 7.8) and publicly available exploit code exists (a PoC gist is linked from NVD), though the product's narrow maritime-navigation deployment base limits broad exposure and no active exploitation is confirmed (no CISA KEV listing).
Technical ContextAI
The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource) in the Windows kernel device-object created by the regService process, which runs with SYSTEM privileges inside SevenCs ORCA G2 2.0.1.35 / EC2007 Kernel v5.22. In Windows, when a driver calls IoCreateDevice without supplying an explicit security descriptor (or with a NULL/default descriptor rather than the secure IoCreateDeviceSecure path), the resulting device object may carry a NULL DACL, which grants full access to all users instead of denying access (an empty DACL would deny everyone; a NULL DACL allows everyone). Any local process that can obtain a handle to that object can then send IOCTLs intended for privileged raw disk operations without further checks, meaning the security boundary intended to be enforced by the kernel object is absent. The affected components are identified by CPE as sevencs:orca_g2:2.0.1.35 and sevencs:ec2007_kernel:5.22, and the impacted functionality is the regService-assisted storage/disk interaction path used on these maritime navigation systems; the primitive gives high confidentiality, integrity, and availability impact (C:H/I:H/A:H) but requires prior low-privileged local code execution (PR:L) and is not remotely reachable (AV:L).
RemediationAI
No vendor-released patch or fixed version is identified in the provided data (no advisory, commit, or fixed version is listed at time of analysis). The primary compensating control is to correct the device-object ACL: reconfigure the object created by regService so that it carries an explicit DACL granting access only to SYSTEM and the specific service account that legitimately requires it, using IoCreateDeviceSecure/SDDL rather than a NULL or absent descriptor - with the trade-off that an incorrectly applied DACL can break the service and any legitimate ORCA G2 disk clients, so the restriction should be validated on a test unit first. Until a patched firmware/software release is obtained from SevenCs, operators should restrict interactive and local logon on affected hosts to fully trusted personnel (reducing the PR:L foothold the exploit needs), monitor for processes opening raw disk devices such as \\.\PhysicalDriveX or issuing raw-disk IOCTLs from non-service accounts, and consider temporarily stopping or disabling regService only if the affected raw-disk functionality is not operationally required - understanding that this may disable legitimate navigation/storage features. Engage SevenCs support for an updated ORCA G2/EC2007 Kernel build, and treat the public PoC gist as a reason to prioritize these local-access restrictions rather than a sign of active exploitation.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today