CVE-2025-0286
Paragon-Software Paragon Backup \& Recovery 15 – 17.39
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-0286 is a high-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Paragon-Software Paragon Backup \& Recovery. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-0286 is an arbitrary kernel memory write vulnerability in the biontdrv.sys driver, affecting various Paragon Software products, particularly those in the Hard Disk Manager product line. The flaw stems from a failure to properly validate the length of user-supplied data, enabling attackers to overwrite kernel memory and execute arbitrary code with kernel-level privileges. It carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-1284 (Improper Validation of Specified Quantity in Input). The vulnerability was published on March 3, 2025.
A local attacker with access to the victim system can exploit this vulnerability without requiring privileges or user interaction. By supplying malformed data to the driver, the attacker can achieve arbitrary code execution in kernel mode, potentially leading to full system compromise, including high-impact confidentiality, integrity, and availability violations.
Paragon Software has released a security patch specifically addressing the biontdrv.sys driver vulnerability across all Hard Disk Manager products, as detailed in their support article. Additional guidance is available from the CERT Coordination Center vulnerability note and Paragon's patches support page, recommending immediate application of the update to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5575
Vulnerability Data
Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim…
more
machine.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.7.2V1.4.2V2.1.1V2.2.1
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validity checks on information inputs, directly stopping acceptance of malformed quantities before they can be used.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper quantity/length validation in input handling.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect missing quantity validation but does not itself implement the control.
Secure development lifecycle mandates input validation for quantity fields, directly preventing CWE-1284.
Application security requirements explicitly call for validation of size/length inputs, mitigating CWE-1284.
Secure architecture principles encourage robust input handling but do not specifically address quantity validation.
Secure coding standards require explicit checks on numeric quantity inputs, fully addressing CWE-1284.