CVE-2025-29547
📋 TL;DR
This vulnerability in Rollback Rx Professional allows local users to trigger a null pointer dereference via a specific IOCtl call to the shieldm.sys driver, causing a denial of service (system crash/BSOD). It affects users of Rollback Rx Professional 12.8.0.0 on Windows systems where the driver is loaded.
💻 Affected Systems
- Rollback Rx Professional
📦 What is this software?
Rollback Rx Pro by Horizondatasys
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash requiring hard reboot, potentially causing data loss or corruption if active operations are interrupted.
Likely Case
Local denial of service resulting in system instability or crash, disrupting user productivity and requiring reboot.
If Mitigated
Minimal impact if proper access controls prevent unauthorized local users from executing the exploit.
🎯 Exploit Status
Exploit details published on Packet Storm; requires local execution with ability to interact with driver.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://horizondatasys.com/rollback-rx-time-machine/rollback-rx-professional/
Restart Required: Yes
Instructions:
1. Check vendor website for security updates. 2. If patch available, download and install. 3. Reboot system to apply changes.
🔧 Temporary Workarounds
Restrict driver access
windowsModify permissions on shieldm.sys to prevent unauthorized users from interacting with the driver.
icacls "C:\Windows\System32\drivers\shieldm.sys" /deny *S-1-1-0:(RX)
Disable driver
windowsPrevent shieldm.sys from loading at system startup.
sc config shieldm start= disabled
sc stop shieldm
🧯 If You Can't Patch
- Uninstall Rollback Rx Professional if not essential for operations.
- Implement strict local user access controls and monitor for suspicious driver interactions.
🔍 How to Verify
Check if Vulnerable:
Check if shieldm.sys driver version is 12.8.0.0 and accessible to local users.Check Version:
powershell Get-Item "C:\Windows\System32\drivers\shieldm.sys" | Select-Object VersionInfoVerify Fix Applied:
Verify driver version is updated beyond 12.8.0.0 or driver permissions are restricted.📡 Detection & Monitoring
Log Indicators:
- System crash logs (Event ID 41)
- Driver interaction failures in system logs
Network Indicators:
- None - local exploit only
SIEM Query:
EventID=41 AND Source="Kernel-Power" | where ProcessName contains "shieldm"