CVE-2025-63602
7.3Awesome Miner · Awesome Miner
A vulnerability in Awesome Miner through 11.2.4 allows unprivileged users to perform arbitrary kernel memory and MSR read/write operations via an insecure WinRing0 driver.
Executive summary
A critical local privilege escalation vulnerability in Awesome Miner allows unprivileged users to achieve kernel-level access, posing a severe risk to system integrity.
Vulnerability
The software utilizes an insecure version of the WinRing0 driver (1.2.0.5), renamed to IntelliBreeze.Maintenance.Service.sys, which lacks a properly secured Discretionary Access Control List (DACL). This flaw enables any unprivileged user to interact directly with the driver to read or write to kernel memory and Model Specific Registers.
Business impact
The ability for an unprivileged user to manipulate kernel memory and system calls represents a complete compromise of the host operating system. Successful exploitation leads to full system control, potential information disclosure, and persistent denial of service. While the CVSS score of 7.3 reflects the high impact, the local privilege escalation capability effectively grants the attacker administrative or system-level authority, which is critical in any enterprise environment.
Remediation
Immediate Action: Review the Awesome Miner download page for the latest security release and apply updates immediately to remove or replace the vulnerable driver.
Proactive Monitoring: Monitor system logs for unauthorized attempts to load or interact with the IntelliBreeze.Maintenance.Service.sys driver or unusual system call patterns.
Compensating Controls: Restrict local user permissions on systems running the service to the absolute minimum required and implement Endpoint Detection and Response (EDR) solutions to identify unauthorized kernel-mode interactions.
Exploitation status
Public Exploit Available: Yes, a public proof-of-concept exists via the GitHub repository D7EAD/CVE-2025-63602.
Analyst recommendation
This vulnerability presents a significant security risk by providing a direct path to kernel-level escalation. Given the existence of public proof-of-concept code, administrators should treat this with high urgency. Ensure all affected instances of Awesome Miner are updated to a version that remediates the insecure driver implementation to prevent potential unauthorized system-wide access.