{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aparagon-softwareparagon_disk_wiper/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:paragon-software:paragon_backup_\\\u0026_recovery:*:*:*:*:*:*:*:*","cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:*","cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:*","cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:*","cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2025-0288"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Paragon Backup \u0026 Recovery (\u003c= 17.39)","Paragon Disk Wiper (\u003c= 16)","Paragon Drive Copy (\u003c= 16)","Paragon Hard Disk Manager (\u003c= 17.39)"],"_cs_severities":["high"],"_cs_tags":["windows","privilege-escalation","driver","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Paragon Software"],"content_html":"\u003cp\u003eA proof-of-concept exploit has been published for CVE-2025-0288, a local privilege escalation vulnerability residing in the 'biontdrv.sys' driver. This driver is associated with several Paragon Software backup and disk management utilities. The vulnerability allows a low-privileged local user to gain high-level system privileges by exploiting an insecure function within the kernel-mode driver.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local user with low privileges to escalate to high-level privileges on the host system. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation provides complete control over confidentiality, integrity, and availability of the affected system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all systems running Paragon Software products, specifically checking for the presence of the 'biontdrv.sys' driver.\u003c/li\u003e\n\u003cli\u003ePrioritize patching for systems where Paragon Software products are installed, as a public PoC is now available.\u003c/li\u003e\n\u003cli\u003eMonitor for the execution of the identified PoC or related exploitation tools on workstations where Paragon software is deployed.\u003c/li\u003e\n\u003cli\u003eEnsure that Windows driver integrity and security hardening policies are enforced to mitigate potential kernel-level exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T22:36:17Z","date_published":"2026-10-28T22:36:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-paragon-driver-lpe/","summary":"CVE-2025-0288 is a local privilege escalation vulnerability in the biontdrv.sys Windows driver used by multiple Paragon Software products, for which a proof-of-concept exploit is publicly available.","title":"Paragon Software: biontdrv.sys local privilege escalation (CVE-2025-0288)","url":"https://feed.craftedsignal.io/briefs/2026-10-paragon-driver-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:paragon-Software:paragon_disk_wiper:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}