CVE-2025-35963 Overview
CVE-2025-35963 is a denial of service vulnerability in Intel(R) PROSet/Wireless WiFi Software for Windows. The flaw resides within Ring 2 device drivers and stems from insufficient control flow management [CWE-691]. Versions prior to 23.160 are affected.
An unprivileged, unauthenticated attacker with adjacent network access can trigger the condition. Exploitation requires no user interaction and is considered low complexity. Successful exploitation impacts only system availability, with no effect on confidentiality or integrity.
Critical Impact
Adjacent attackers can crash the wireless driver stack, disrupting connectivity on affected Windows endpoints without authentication or user interaction.
Affected Products
- Intel(R) PROSet/Wireless WiFi Software for Windows versions before 23.160
- Windows endpoints running affected Intel wireless device drivers
- Systems with Intel wireless adapters managed by the vulnerable driver stack
Discovery Timeline
- 2025-11-11 - CVE-2025-35963 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-35963
Vulnerability Analysis
The vulnerability is classified as Improper Control Flow Management [CWE-691] within the Intel PROSet/Wireless WiFi driver. The driver operates at Ring 2 (device driver privilege), meaning crashes can disrupt the wireless subsystem and connected services. Because the issue affects the driver layer, exploitation does not require local authentication on the target host.
An attacker positioned on the same wireless segment can deliver crafted frames or protocol input that the driver fails to handle along expected control paths. The result is a denial of service condition affecting wireless connectivity and dependent system functionality. According to the EPSS dataset, the probability of observed exploitation remains low at the time of publication.
Root Cause
The root cause is insufficient validation and management of control flow within the wireless driver. When the driver receives unexpected input through adjacent network communication, execution paths can reach states that lead to a service halt. The Intel advisory tracks this issue as SA-01398.
Attack Vector
The attack vector is adjacent network access, meaning the attacker must share the same physical or logical wireless network segment as the target. No privileges and no user interaction are required. The attacker sends specially crafted wireless traffic processed by the vulnerable driver to trigger the denial of service. Refer to the Intel Security Advisory SA-01398 for vendor-confirmed technical details.
Detection Methods for CVE-2025-35963
Indicators of Compromise
- Unexpected Intel wireless driver crashes or repeated Netwtw*.sys faults recorded in the Windows Event Log
- Sudden loss of WiFi connectivity across multiple endpoints on the same wireless segment
- Bug check events referencing the Intel PROSet/Wireless driver module
Detection Strategies
- Monitor Windows Reliability Monitor and System event channel for Intel wireless driver fault entries
- Correlate WLAN disconnect events with concurrent presence of unknown devices on the wireless segment
- Inventory endpoints to identify hosts running Intel PROSet/Wireless WiFi Software versions earlier than 23.160
Monitoring Recommendations
- Alert on driver crash frequency exceeding baseline thresholds on Windows hosts with Intel wireless adapters
- Track WLAN authentication and association anomalies on enterprise wireless infrastructure
- Audit installed driver versions during routine compliance scans and flag versions below 23.160
How to Mitigate CVE-2025-35963
Immediate Actions Required
- Update Intel PROSet/Wireless WiFi Software for Windows to version 23.160 or later
- Identify all endpoints with Intel wireless adapters and prioritize patching for mobile and remote users
- Restrict access to sensitive wireless networks using enterprise authentication (WPA2/WPA3-Enterprise)
Patch Information
Intel addressed this vulnerability in PROSet/Wireless WiFi Software version 23.160. Apply the update referenced in the Intel Security Advisory SA-01398. Deploy through standard endpoint management tooling and verify driver versions after installation.
Workarounds
- Disable wireless adapters on endpoints that do not require WiFi connectivity until patches are applied
- Limit exposure by avoiding untrusted wireless networks where adjacent attackers may operate
- Segment guest and untrusted wireless networks from corporate SSIDs to reduce adjacent attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
