CVE-2025-30255: Intel PROSet WiFi Software DoS Vulnerability

CVE-2025-30255 Overview

CVE-2025-30255 is an out-of-bounds write vulnerability [CWE-787] affecting Intel PROSet/Wireless WiFi Software for Windows before version 23.160. The flaw resides in Ring 2 device driver code and can be triggered by an unauthenticated, unprivileged adversary over an adjacent network. Successful exploitation allows denial of service against the affected system.

The issue carries a CVSS 4.0 base score of 8.3. No user interaction is required, attack complexity is low, and exploitation does not require special internal knowledge of the target. The vulnerability primarily impacts availability, with limited integrity impact and no confidentiality impact.

Critical Impact
An adjacent-network attacker can crash systems running vulnerable Intel PROSet/Wireless WiFi drivers, disrupting wireless connectivity and host availability without authentication or user interaction.

Affected Products

Intel PROSet/Wireless WiFi Software for Windows versions prior to 23.160
Intel wireless device drivers operating in Ring 2 (kernel device driver context)
Windows endpoints relying on the affected Intel wireless stack for connectivity

Discovery Timeline

2025-11-11 - CVE-2025-30255 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-30255

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] within Intel PROSet/Wireless WiFi Software for Windows. The defect exists in device driver code that runs in Ring 2, giving the affected component privileged access to system resources. When the driver processes specific wireless input, it writes past the bounds of an allocated buffer.

This memory corruption destabilizes kernel-level driver structures and forces the affected system into a denial-of-service state. The Intel security advisory describes integrity impact as low and availability impact as high, consistent with a crash rather than arbitrary code execution. No public proof-of-concept code is available, and the EPSS probability remains low at the time of publication.

Root Cause

The root cause is missing or insufficient bounds checking when the Intel wireless driver handles attacker-influenced data. The driver writes data to a buffer without validating that the destination size is large enough, corrupting adjacent memory. Because the code path executes in Ring 2 device driver context, the resulting corruption affects kernel state and triggers system instability.

Attack Vector

The attack vector is adjacent network (AV:A in the CVSS 4.0 vector). An adversary must be within wireless range of the target or otherwise reach the same logical network segment serviced by the wireless adapter. The attacker sends crafted wireless frames or protocol messages that the vulnerable driver processes, triggering the out-of-bounds write. Authentication is not required, no user interaction is needed, and attack complexity is low.

No verified exploit code is publicly available. See the Intel Security Advisory SA-01398 for vendor technical details.

Detection Methods for CVE-2025-30255

Indicators of Compromise

Unexpected bug checks (BSOD) referencing Intel wireless driver modules such as Netwtw*.sys on affected Windows hosts
Repeated wireless adapter resets, driver restarts, or loss of wireless connectivity on hosts within range of an untrusted attacker
Crash dumps containing stack frames inside Intel PROSet/Wireless WiFi driver components

Detection Strategies

Inventory Windows endpoints and identify systems running Intel PROSet/Wireless WiFi Software prior to version 23.160
Correlate Windows kernel crash events (Event ID 1001, BugCheck) with Intel wireless driver modules across the fleet
Monitor wireless infrastructure logs for anomalous 802.11 management or data frames targeting client stations

Monitoring Recommendations

Centralize Windows Reliability and WHEA events to surface clusters of wireless driver crashes that may indicate exploitation attempts
Track driver and software versions for Intel wireless components through endpoint management telemetry
Alert on repeated wireless disconnect or reauthentication patterns from the same source MAC near affected hosts

How to Mitigate CVE-2025-30255

Immediate Actions Required

Update Intel PROSet/Wireless WiFi Software for Windows to version 23.160 or later on all affected endpoints
Prioritize patching for mobile and laptop fleets that connect to untrusted wireless networks
Validate that endpoint management tooling reports the post-patch driver version after deployment

Patch Information

Intel has released fixed software in version 23.160 of PROSet/Wireless WiFi Software for Windows. Refer to the Intel Security Advisory SA-01398 for the authoritative list of fixed versions and download locations.

Workarounds

Disable the Intel wireless adapter on hosts that do not require wireless connectivity until the patch is applied
Restrict connections to trusted, encrypted wireless networks (WPA2/WPA3 Enterprise) to limit adjacent-network exposure
Use wired connectivity for high-value endpoints where patch deployment is delayed

bash

# Configuration example: disable Intel wireless adapter on Windows until patched
Get-NetAdapter -InterfaceDescription "Intel(R) Wi-Fi*" | Disable-NetAdapter -Confirm:$false