CVE-2025-64699
📋 TL;DR
This vulnerability allows local attackers to perform unauthorized raw disk operations due to an incorrect NULL DACL in SevenCs ORCA G2's regService process running with SYSTEM privileges. Attackers could disrupt systems, expose sensitive data, or escalate privileges locally. Only systems running SevenCs ORCA G2 2.0.1.35 with EC2007 Kernel v5.22 are affected.
💻 Affected Systems
- SevenCs ORCA G2
📦 What is this software?
Orca G2 by Sevencs
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to SYSTEM, complete system compromise, data exfiltration, and persistent backdoor installation.
Likely Case
Local attackers gaining unauthorized disk access, potentially reading sensitive files or causing system instability through disk manipulation.
If Mitigated
Limited impact if proper access controls and monitoring are in place, though the vulnerability still exists.
🎯 Exploit Status
Exploitation requires local access but is straightforward once access is obtained. The GitHub gist provides technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check with SevenCs for security updates. Monitor their security advisories for patch availability.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local user access to systems running vulnerable software to trusted personnel only.
Monitor regService Process
windowsImplement process monitoring for regService to detect unauthorized access attempts.
🧯 If You Can't Patch
- Isolate affected systems from critical networks and sensitive data.
- Implement strict access controls and audit all local user activities on vulnerable systems.
🔍 How to Verify
Check if Vulnerable:
Check if SevenCs ORCA G2 version 2.0.1.35 is installed and running with EC2007 Kernel v5.22. Verify regService process is running with SYSTEM privileges.Check Version:
Check application version through SevenCs ORCA G2 interface or Windows installed programs list.Verify Fix Applied:
Verify that a patched version from SevenCs is installed and that regService no longer applies NULL DACLs to device objects.📡 Detection & Monitoring
Log Indicators:
- Unusual disk access patterns by regService process
- Failed or successful privilege escalation attempts
- Access to device objects without proper DACLs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Process:regService AND (EventID:4656 OR EventID:4663) AND ObjectType:Device