CVE-2025-50892 Details
Description
The eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1 fails to properly validate privileges for I/O requests (IRP_MJ_READ/IRP_MJ_WRITE) sent to its device object. This allows a local, low-privileged attacker to perform arbitrary raw disk reads and writes, leading to sensitive information disclosure, denial of service, or local privilege escalation.
A vulnerability exists in the eudskacs.sys driver, specifically in version 20250328, which is included with EaseUS Todo Backup 1.2.0.1. The driver does not properly validate privileges for input/output requests related to reading and writing operations. This flaw enables a local, low-privileged attacker to execute arbitrary raw disk read and write commands. The consequences of this vulnerability include unauthorized access to sensitive information, potential denial of service, and local privilege escalation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/christopher-ellis-workday/756c998f9f59dd2c437d83e60c7ed220 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| easeus eudskacs.sys driver | 20250328 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2025 | Initial Analysis | [email protected] |
| Sep 10, 2025 | CVE Modified | CISA-ADP |
| Sep 10, 2025 | New CVE Received | [email protected] |