CVE-2025-50892 in Todo Backup
Summary
by MITRE • 09/10/2025
The eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1 fails to properly validate privileges for I/O requests (IRP_MJ_READ/IRP_MJ_WRITE) sent to its device object. This allows a local, low-privileged attacker to perform arbitrary raw disk reads and writes, leading to sensitive information disclosure, denial of service, or local privilege escalation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/11/2025
The vulnerability identified as CVE-2025-50892 resides within the eudskacs.sys kernel driver component of EaseUs Todo Backup version 1.2.0.1, representing a critical privilege escalation flaw that undermines the security boundaries of the Windows operating system. This driver operates at the kernel level and handles I/O requests for disk operations, making it a prime target for attackers seeking to elevate their privileges or access sensitive system resources. The flaw specifically manifests in the driver's inadequate validation of access rights for read and write operations, creating a pathway for unauthorized manipulation of system disk data.
The technical implementation of this vulnerability stems from the driver's failure to properly enforce privilege checks during I/O request processing. When the eudskacs.sys driver receives IRP_MJ_READ or IRP_MJ_WRITE requests, it does not adequately verify whether the requesting process possesses the necessary privileges to perform the requested operations. This oversight allows a low-privileged user account to submit I/O requests that would normally be restricted to system-level processes or administrators. The vulnerability aligns with CWE-284, which addresses improper access control mechanisms, and demonstrates a classic case of insufficient privilege validation in kernel-mode components.
The operational impact of this vulnerability extends far beyond simple information disclosure, as it enables a range of malicious activities that can severely compromise system integrity and availability. A local attacker with minimal privileges can leverage this flaw to perform arbitrary raw disk reads, potentially accessing sensitive data stored on the system, including encryption keys, password hashes, and system configuration files. Additionally, the ability to perform arbitrary writes allows for modification of critical system files, enabling persistent backdoor installation or system corruption that could lead to denial of service conditions. The privilege escalation potential makes this vulnerability particularly dangerous as it could allow attackers to gain SYSTEM-level access to the compromised machine.
Mitigation strategies for CVE-2025-50892 should focus on immediate remediation through official vendor updates, as the vulnerability exists within a third-party driver component that requires patching from EaseUs. System administrators should implement additional protective measures including restricting user access to the affected software, monitoring for unusual I/O patterns that might indicate exploitation attempts, and employing kernel-mode protection mechanisms such as Windows Driver Verifier to detect potentially malicious driver behavior. The vulnerability also aligns with ATT&CK technique T1068, which covers 'Exploitation for Privilege Escalation', and organizations should consider implementing monitoring for suspicious privilege escalation activities. Additionally, defense-in-depth strategies should include regular security assessments of installed software components, particularly those with kernel-level access, and maintaining up-to-date threat intelligence to identify potential exploitation attempts targeting similar driver-based vulnerabilities.