A critical denial of service vulnerability in the Prevx v3.0.5.220 pxscan.sys driver allows remote attackers to terminate sensitive system processes.

This flaw involves an improper input validation issue in the pxscan.sys driver, where sending IOCTL code 0x22E044 triggers the termination of any process listed in the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\pxscan\Files. The vulnerability is exploitable by unauthenticated attackers.

The ability for an unauthenticated attacker to remotely terminate arbitrary system processes represents a significant threat to operational continuity. By targeting critical security or system services, an attacker could induce system instability, disrupt business functions, or bypass local security controls. With a CVSS score of 7.5, this vulnerability is classified as High severity due to its potential for widespread service disruption.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the vendor website for security updates and restrict access to the affected driver interface where possible.

Proactive Monitoring: Monitor system logs for unexpected process terminations and investigate any unauthorized attempts to communicate with the pxscan.sys driver or interact with the associated registry path.

Compensating Controls: Implement host based intrusion detection systems to alert on abnormal IOCTL requests and audit the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\pxscan\Files to ensure only authorized processes are registered.

Public Exploit Available: Yes — a public proof of concept is available via the GitHub repository at https://github.com/djackreuter/CVE-2025-60349.

Given the high impact of this denial of service vulnerability and the availability of public proof of concept code, this issue should be treated with urgency. Organizations using the affected version of Prevx v3 should prioritize identifying vulnerable instances and applying vendor patches as soon as they become available to prevent potential service outages.