CVE-2025-63602

A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) as an unprivileged user. This is due to the implementation of an insecure version of WinRing0 (1.2.0.5, renamed to IntelliBreeze.Maintenance.Service.sys) that lacks a properly secured DACL, allowing unprivileged users to interact with the driver and, as a result, the kernel. This can result in local privilege escalation, information disclosure, denial of service, and other unspecified impacts.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://dreadsec.co/p/cve-2025-63602-hijacking-system-calls-with-a-popular-crypto-miner.html	Exploit Third Party Advisory
https://www.awesomeminer.com/download	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:awesomeminer:awesome_miner:11.2.4:*:*:*:*:*:*:*

History

19 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue descubierta en Awesome Miner hasta la versión 11.2.4 que permite lectura y escritura arbitrarias en la memoria del kernel y en los MSRs (como LSTAR) como un usuario no privilegiado. Esto se debe a la implementación de una versión insegura de WinRing0 (1.2.0.5, renombrada a IntelliBreeze.Maintenance.Service.sys) que carece de una DACL debidamente asegurada, permitiendo a usuarios no privilegiados interactuar con el controlador y, como resultado, con el kernel. Esto puede resultar en escalada de privilegios local, revelación de información, denegación de servicio y otros impactos no especificados.

Information

Published : 2025-11-18 16:15

Updated : 2026-10-19 21:10

NVD link : CVE-2025-63602

Mitre link : CVE-2025-63602

CVE.ORG link : CVE-2025-63602

JSON object : View

Products Affected

awesomeminer

awesome_miner

CWE

CWE-126

Buffer Over-read

{"id": "CVE-2025-63602", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-63602", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-18T17:03:37.460705Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-11-18T16:15:45.593", "references": [{"url": "https://dreadsec.co/p/cve-2025-63602-hijacking-system-calls-with-a-popular-crypto-miner.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.awesomeminer.com/download", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-126"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) as an unprivileged user. This is due to the implementation of an insecure version of WinRing0 (1.2.0.5, renamed to IntelliBreeze.Maintenance.Service.sys) that lacks a properly secured DACL, allowing unprivileged users to interact with the driver and, as a result, the kernel. This can result in local privilege escalation, information disclosure, denial of service, and other unspecified impacts."}, {"lang": "es", "value": "Una vulnerabilidad fue descubierta en Awesome Miner hasta la versi\u00f3n 11.2.4 que permite lectura y escritura arbitrarias en la memoria del kernel y en los MSRs (como LSTAR) como un usuario no privilegiado. Esto se debe a la implementaci\u00f3n de una versi\u00f3n insegura de WinRing0 (1.2.0.5, renombrada a IntelliBreeze.Maintenance.Service.sys) que carece de una DACL debidamente asegurada, permitiendo a usuarios no privilegiados interactuar con el controlador y, como resultado, con el kernel. Esto puede resultar en escalada de privilegios local, revelaci\u00f3n de informaci\u00f3n, denegaci\u00f3n de servicio y otros impactos no especificados."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:awesomeminer:awesome_miner:11.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "918D856C-EE5E-4B5F-AB6C-8401754C2208"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}