CVE-2025-45737
📋 TL;DR
This vulnerability allows attackers to escalate privileges by sending crafted IOCTL commands to the NeacSafe64.sys driver component. It affects systems running NetEase NeacSafe64 Driver versions before v1.0.0.8, potentially enabling local attackers to gain elevated system privileges.
💻 Affected Systems
- NetEase NeacSafe64 Driver
📦 What is this software?
Neacsafe64 by Netease
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM/root privileges, enabling installation of persistent malware, credential theft, and disabling of security controls.
Likely Case
Local privilege escalation allowing attackers to bypass security restrictions, install additional malware, or access protected system resources.
If Mitigated
Limited impact if proper privilege separation and driver signing enforcement are in place, though local attackers could still gain elevated access.
🎯 Exploit Status
Public GitHub repository contains proof-of-concept code. Exploitation requires local access and ability to send IOCTL commands to the driver.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.0.0.8 or later
Vendor Advisory: Unknown - no official vendor advisory found in provided references
Restart Required: Yes
Instructions:
1. Check current driver version. 2. Contact NetEase for updated driver v1.0.0.8+. 3. Install updated driver. 4. Reboot system to load new driver.
🔧 Temporary Workarounds
Disable or remove vulnerable driver
windowsRemove or disable the NeacSafe64.sys driver if not essential for system operation
sc stop NeacSafe64
sc delete NeacSafe64
Remove NeacSafe64.sys from system32\drivers
Restrict driver access permissions
windowsModify ACLs to restrict access to the driver device object
icacls \\.\NeacSafe64 /deny *S-1-1-0:(RX)
🧯 If You Can't Patch
- Implement strict privilege separation and least privilege principles for all user accounts
- Monitor for suspicious driver interactions and IOCTL calls using EDR/sysmon
🔍 How to Verify
Check if Vulnerable:
Check driver version in Device Manager or via 'driverquery | findstr NeacSafe64'. If version is below 1.0.0.8, system is vulnerable.Check Version:
driverquery /v | findstr /i NeacSafe64Verify Fix Applied:
Verify driver version is 1.0.0.8 or higher and test privilege escalation attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unusual IOCTL calls to NeacSafe64.sys
- Driver loading events for NeacSafe64
- Privilege escalation attempts
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
EventID=7045 AND ServiceName="NeacSafe64" OR ProcessName="NeacSafe64.sys" AND CommandLine contains "ioctl"