CVE-2025-8301
📋 TL;DR
A heap-based buffer overflow vulnerability in Realtek RTL8811AU wireless driver allows local attackers to escalate privileges from low-privileged user accounts to SYSTEM level. This affects systems using vulnerable versions of the Realtek RTL8811AU driver. Attackers must first gain local code execution to exploit this vulnerability.
💻 Affected Systems
- Realtek RTL8811AU Wireless LAN 802.11ac USB NIC Driver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full SYSTEM privileges, enabling complete system compromise, data theft, persistence establishment, and lateral movement capabilities.
Likely Case
Local attacker with initial access escalates to SYSTEM privileges to install malware, steal credentials, or maintain persistence on compromised systems.
If Mitigated
With proper privilege separation and driver signing enforcement, impact limited to denial of service or driver crashes.
🎯 Exploit Status
Requires local code execution first, then exploitation of heap overflow in driver function. ZDI advisory suggests exploit development is feasible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - check Realtek or device manufacturer updates
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-880/
Restart Required: Yes
Instructions:
1. Check device manufacturer website for updated RTL8811AU driver. 2. Download and install latest driver. 3. Reboot system to load new driver.
🔧 Temporary Workarounds
Disable vulnerable driver
windowsDisable or uninstall the Realtek RTL8811AU driver if not needed
sc config rtwlanu start= disabled
pnputil /remove-device "USB\VID_0BDA&PID_8811"
Restrict driver loading
windowsUse driver block rules to prevent vulnerable driver loading
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Driver Security" /v "DriverBlockPolicy" /t REG_DWORD /d 1 /f
🧯 If You Can't Patch
- Implement strict privilege separation - ensure users operate with minimal necessary privileges
- Monitor for suspicious driver loading events and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check driver version: Open Device Manager > Network adapters > Realtek RTL8811AU > Properties > Driver tabCheck Version:
driverquery /v | findstr /i rtwlanuVerify Fix Applied:
Verify driver version is updated and no longer matches vulnerable versions. Check that rtwlanu.sys file date is recent.📡 Detection & Monitoring
Log Indicators:
- Windows Event ID 4697 (Service installed), suspicious driver loading
- Unexpected SYSTEM privilege processes from user accounts
- Driver crash events for rtwlanu.sys
Network Indicators:
- Not applicable - local exploitation only
SIEM Query:
EventID=4697 AND ServiceName="rtwlanu" OR ProcessName="rtwlanu.sys" AND ParentProcess NOT IN ("services.exe", "svchost.exe")