A critical privilege escalation vulnerability exists in ThreatFire System Monitor v4.7.0.53 that allows local attackers to gain full system control.

This vulnerability involves incorrect access control within the kernel driver, specifically via an insecure Input/Output Control (IOCTL) interface, which can be exploited by an authenticated local user to achieve arbitrary command execution with system-level privileges.

Successful exploitation of this vulnerability allows a local user with low privileges to escalate to system-level access, effectively bypassing all security boundaries on the host. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to complete system compromise, unauthorized data access, and the deployment of persistent malicious software within the enterprise environment.

Immediate Action: Restrict access to the affected system from unauthorized local users while awaiting a vendor-supplied patch or update for version 4.7.0.53.

Proactive Monitoring: Monitor system logs for unusual kernel-level activities or attempts to interact with the ThreatFire driver via IOCTL.

Compensating Controls: Implement strict endpoint privilege management to ensure that only authorized users can execute code or interact with sensitive kernel-level drivers.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub (D7EAD/CVE-2025-61156).

This vulnerability presents a significant risk to host integrity due to the potential for local privilege escalation. Security teams should prioritize limiting local access to systems running this specific version of the ThreatFire System Monitor and monitor for vendor updates to resolve the insecure IOCTL implementation.