CVE-2025-50892: Easeus Eudskacs.sys Privilege Escalation

CVE-2025-50892 Overview

CVE-2025-50892 affects the eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1. The driver fails to validate caller privileges for IRP_MJ_READ and IRP_MJ_WRITE I/O requests sent to its device object. A local, low-privileged attacker can issue arbitrary raw disk reads and writes through the exposed device interface. Exploitation leads to sensitive information disclosure, denial of service, or local privilege escalation. The weakness is classified as [CWE-269] Improper Privilege Management. No public exploitation has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A low-privileged local user can perform raw disk reads and writes through the vulnerable driver, enabling credential theft from disk structures and full local privilege escalation to SYSTEM.

Affected Products

EaseUs Todo Backup 1.2.0.1
EaseUs eudskacs.sys driver version 20250328
Windows systems where the vulnerable driver is loaded

Discovery Timeline

2025-09-10 - CVE-2025-50892 published to the National Vulnerability Database
2026-07-05 - Last updated in NVD database

Technical Details for CVE-2025-50892

Vulnerability Analysis

The eudskacs.sys kernel-mode driver exposes a device object that accepts IRP_MJ_READ and IRP_MJ_WRITE I/O request packets from user mode. The driver dispatch routines do not verify whether the caller holds sufficient privileges before servicing the request. Because the driver executes in ring 0, any request it honors is executed with kernel authority, bypassing the normal access controls enforced on \Device\Harddisk* objects. An attacker who can open a handle to the driver's device namespace can therefore read and write arbitrary sectors of any physical disk on the system.

Raw disk access at this level enables an attacker to extract the SAM and SYSTEM registry hives, harvest LSA secrets, or overwrite the Master Boot Record and NTFS metadata. Writing crafted bytes into privileged files such as service binaries or scheduled task definitions provides a reliable path to SYSTEM-level code execution.

Root Cause

The root cause is missing access control on the driver's device object combined with the absence of a caller-privilege check inside the read and write dispatch handlers. The driver should restrict its DACL to administrators and additionally validate the requestor's token before performing sector I/O. Neither control is present in version 20250328.

Attack Vector

Exploitation requires local access with low privileges. The attacker opens a handle to the driver's device object using CreateFile, then issues ReadFile and WriteFile calls with offsets targeting the physical disk. No user interaction is required. A proof-of-concept demonstrating the primitive is published in the GitHub Gist PoC Repository.

Detection Methods for CVE-2025-50892

Indicators of Compromise

Presence of eudskacs.sys version 20250328 on hosts that do not require EaseUs Todo Backup functionality
Unexpected user-mode processes opening handles to the eudskacs device object
Sector-level writes to physical disks originating from non-administrative processes

Detection Strategies

Monitor kernel driver load events (Windows Event ID 6 in Sysmon) for eudskacs.sys on systems where EaseUs Todo Backup is not authorized
Alert on CreateFile operations targeting the driver's device object from processes running under standard user tokens
Correlate raw disk I/O activity with parent process lineage to identify suspicious sector reads or writes

Monitoring Recommendations

Enable auditing of file system integrity for SAM, SYSTEM, and SECURITY registry hive files
Track loaded driver inventory across the fleet and flag any host running the vulnerable version
Ingest driver load and process telemetry into a centralized data lake for retrospective hunting against the eudskacs.sys hash

How to Mitigate CVE-2025-50892

Immediate Actions Required

Uninstall EaseUs Todo Backup 1.2.0.1 from systems where it is not operationally required
Block the vulnerable eudskacs.sys driver using the Microsoft vulnerable driver blocklist or Windows Defender Application Control (WDAC)
Restrict local logon rights and limit membership in local user groups to reduce the attacker population

Patch Information

No vendor advisory or fixed version has been published in the enriched CVE data at the time of writing. Monitor EaseUs product release notes for an updated eudskacs.sys driver that enforces caller privilege validation on IRP_MJ_READ and IRP_MJ_WRITE dispatch routines.

Workarounds

Remove or rename eudskacs.sys on hosts that do not need EaseUs Todo Backup, preventing the driver from loading
Deploy a WDAC or AppLocker policy that denies loading of the driver by SHA-256 hash
Enable the Microsoft recommended driver blocklist through Smart App Control or Memory Integrity to block known vulnerable drivers

bash

# Example: Query loaded drivers and check for the vulnerable file
sc.exe query type= driver | findstr /I "eudskacs"
driverquery /v /fo csv | findstr /I "eudskacs.sys"

# Enable Microsoft vulnerable driver blocklist (Windows 11 / Server 2022+)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f