CVE-2025-66680 in Wise Force Deleter
Summary
by MITRE • 03/03/2026
An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files via a crafted request.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/04/2026
The vulnerability identified as CVE-2025-66680 resides within the WiseDelfile64.sys kernel driver component of WiseCleaner Wise Force Deleter version 7.3.2 and earlier. This driver operates at the kernel level within the Windows operating system, providing functionality for file deletion operations. The issue manifests as a privilege escalation vulnerability that allows unauthenticated attackers to craft malicious requests that can result in arbitrary file deletion across the target system. The kernel driver interface lacks proper input validation and access control mechanisms, creating a pathway for malicious actors to exploit the system's file deletion capabilities beyond their intended scope.
The technical flaw stems from insufficient validation of user-supplied parameters within the kernel driver's handling routines. When the WiseDelfile64.sys component processes incoming requests for file deletion operations, it fails to properly sanitize or validate the file paths and access permissions specified in these requests. This weakness enables attackers to manipulate the driver's behavior through crafted input parameters that bypass normal file system access controls and security boundaries. The vulnerability represents a classic example of improper input validation and inadequate privilege separation, commonly categorized under CWE-20 - Improper Input Validation and CWE-269 - Improper Privilege Management. The driver's interface appears to accept file paths without adequate verification of their legitimacy or the attacker's authorization to delete the specified resources.
Operationally, this vulnerability presents a severe risk to system integrity and data security as it allows attackers to delete critical system files, user data, or application components without proper authentication or authorization. The impact extends beyond simple file deletion to potentially cause system instability, application failures, or complete system compromise depending on which files are targeted. An attacker could exploit this vulnerability to remove security-related files, system binaries, or user documents, potentially leading to denial of service conditions or creating opportunities for further exploitation. The attack surface is particularly concerning given that the vulnerability affects a kernel-level driver, meaning successful exploitation could provide attackers with elevated privileges and persistent access to the compromised system. This aligns with ATT&CK technique T1059.003 - Command and Scripting Interpreter: Windows Command Shell, where attackers may leverage such capabilities to execute destructive operations or establish persistence.
Mitigation strategies for CVE-2025-66680 should prioritize immediate patching of the WiseCleaner Wise Force Deleter software to version 7.3.3 or later, which contains the necessary security fixes for the kernel driver vulnerability. Organizations should also implement network segmentation and access controls to limit exposure of systems running this software to untrusted networks or users. System administrators should conduct thorough vulnerability assessments to identify all instances of the affected software across the enterprise environment and apply remediation measures accordingly. Additionally, monitoring for suspicious file deletion activities and implementing proper file system access controls can help detect and prevent exploitation attempts. The vulnerability highlights the importance of proper driver security practices and input validation in kernel-level components, aligning with security best practices outlined in NIST SP 800-144 and ISO/IEC 27001 standards for system security management.