Multiple vulnerabilities in Humming Heads Defense Platform Home Edition



Risk Low
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2025-24483
CVE-2025-23236
CVE-2025-24845
CVE-2025-22890
CVE-2025-20094
CVE-2025-22894
CWE-ID CWE-476
CWE-119
CWE-88
CWE-250
CWE-422
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Defense Platform Home Edition
Client/Desktop applications / Antivirus software/Personal firewalls

Vendor Humming Heads

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU103621

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-24483

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in DeviceIoControl. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Defense Platform Home Edition: - - 3.9.51

CPE2.3 External links

https://jvn.jp/en/jp/JVN66673020/index.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU103622

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-23236

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in DeviceIoControl. A local user can trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Defense Platform Home Edition: - - 3.9.51

CPE2.3 External links

https://jvn.jp/en/jp/JVN66673020/index.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Neutralization of Argument Delimiters in a Command

EUVDB-ID: #VU103623

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-24845

CWE-ID: CWE-88 - Argument Injection or Modification

Exploit availability: No

Description

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the argument injection issue in DPprd.sys and DPavd.sys. A local attacker can use a specially crafted data and cause a denial of service condition on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Defense Platform Home Edition: - - 3.9.51

CPE2.3 External links

https://jvn.jp/en/jp/JVN66673020/index.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Execution with unnecessary privileges

EUVDB-ID: #VU103625

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22890

CWE-ID: CWE-250 - Execution with Unnecessary Privileges

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application binary has a setuid bit. A local user can gain elevated privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Defense Platform Home Edition: - - 3.9.51

CPE2.3 External links

https://jvn.jp/en/jp/JVN66673020/index.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Unprotected Windows Messaging Channel ('Shatter')

EUVDB-ID: #VU103626

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-20094

CWE-ID: CWE-422 - Unprotected Windows Messaging Channel (\'Shatter\')

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to improper handling of message in specific process. A local user can send a specially crafted message and execute arbitrary code on the target system with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Defense Platform Home Edition: - - 3.9.51

CPE2.3 External links

https://jvn.jp/en/jp/JVN66673020/index.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Unprotected Windows Messaging Channel ('Shatter')

EUVDB-ID: #VU103628

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22894

CWE-ID: CWE-422 - Unprotected Windows Messaging Channel (\'Shatter\')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper handling of message in specific process. A local user can send a specially crafted message and gain elevated privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Defense Platform Home Edition: - - 3.9.51

CPE2.3 External links

https://jvn.jp/en/jp/JVN66673020/index.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###