EUVD-2025-209526
GHSA-42p2-73mx-2pch
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications. Unauthorized processes load the driver and send a crafted IOCTL request (0xB822200C) to terminate processes protected by a third-party implementation. This action exploits insufficient caller validation in the driver's IOCTL handler, allowing unauthorized processes to perform termination operations in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications.
AnalysisAI
STProcessMonitor 11.11.4.0 driver in Safetica Application suite allows local privileged users to send crafted IOCTL requests (0xB822200C) that terminate processes protected by third-party security implementations due to insufficient caller validation in the kernel-mode driver handler. This enables denial of service attacks against critical services without requiring user interaction. Publicly available exploit code exists, and the vulnerability is tracked in CISA's LOLDrivers database as a legitimate-but-abused Windows driver.
Technical ContextAI
STProcessMonitor is a kernel-mode device driver component of the Safetica Application suite that manages process monitoring and control on Windows systems. The vulnerability stems from CWE-269 (Improper Privilege Management) - specifically, the driver's IOCTL handler for control code 0xB822200C fails to properly validate the caller's authorization before executing privileged kernel operations. The driver accepts requests from user-mode applications with Local (L) privilege level to terminate arbitrary processes, including those protected by third-party endpoint security tools. This represents a classic example of a 'Living off the Land Driver' (LOLDriver) - a legitimately signed Windows driver with insufficient access controls that can be weaponized by lower-privileged users to bypass security mechanisms. The Safetica suite is deployed in enterprise environments as an information security and data loss prevention (DLP) solution, making this driver a high-value target for attackers seeking to disable competing protection mechanisms.
RemediationAI
Update Safetica Application suite to a patched version released after STProcessMonitor 11.11.4.0; consult vendor release notes to confirm IOCTL handler validation improvements. If immediate patching is unavailable, implement the following compensating controls with their trade-offs: (1) Restrict driver load permissions - use Windows Device Guard / HVCI (Hypervisor-protected Code Integrity) to prevent unsigned or non-approved drivers from loading; this may impact legacy application compatibility. (2) Block unsigned driver execution via AppLocker or Device Control policies targeting the STProcessMonitor.sys file; verify this does not break legitimate Safetica functionality. (3) Limit local admin/elevated privilege assignments to only those users and service accounts that require them; use Just-In-Time (JIT) privileged access management (PAM) to reduce standing privileges. (4) Monitor IOCTL code 0xB822200C via Event Tracing for Windows (ETW) or kernel debugging to detect attempted exploitation; requires Windows kernel debugging setup and log aggregation capability. References: GitHub LOLDrivers issue #268 (https://github.com/magicsword-io/LOLDrivers/issues/268) documents driver exploit vectors; NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2025-70795) provides official vulnerability timeline.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today