CVE Feed

    Dashboard / CVE / CVE-2025-64699

    CVE-2025-64699

    An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privileges, applies a Security Descriptor to a device object with no explicitly configured DACL. This condition could allow an attacker to perform unauthorized raw disk operations, which could lead to system disruption (DoS) and exposure of sensitive data, and may facilitate local privilege escalation.

    Published:Dec 31, 2025
    Last Modified:Jan 14, 2026
    EPS:Dec 31, 2025
    EPSS Score:0.00013
    CVSS Score:7.8

    Affected Products

    Vendor
    Sevencs
    Product
    Ec2007 Kernel
    Vendor
    Sevencs
    Product
    Orca G2

    Exploits

    https://gist.github.com/GunP4ng/42b19ee99e94c315173b74a9fb26c2b9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High