PT-2020-13600 · Softperfect · Softperfect Ram Disk

Published 2020-08-04 · Updated 2022-06-07 · CVE-2020-13523

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SoftPerfect RAM Disk version 4.1

Description An exploitable information disclosure issue exists in the spvve.sys driver. A specially crafted I/O request packet (IRP) can cause the disclosure of sensitive information. An attacker can send a malicious IRP to trigger this issue.

Recommendations For SoftPerfect RAM Disk version 4.1, consider disabling the spvve.sys driver as a temporary workaround until a patch is available. Restrict access to the driver to minimize the risk of exploitation. Avoid using the driver in sensitive environments until the issue is resolved.

Exploit

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

CVE-2020-13523

Affected Products

Softperfect Ram Disk

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1122 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13523 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13523 · Vendor Advisory
• https://t.me/cibsecurity/13873 · Telegram Post