PT-2024-14502 · Unknown · Wsftprm.Sys+1

Alex Oudenaarden + 2 · Published 2024-01-08 · Updated 2026-02-22 · CVE-2023-52271

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Topaz Antifraud versions prior to 2.0.0.0

Description The wsftprm.sys kernel driver in Topaz Antifraud allows attackers with limited privileges to terminate any Protected Process Light process through the use of an IOCTL. This allows for the potential silencing of security products like Antivirus and Endpoint Detection and Response (EDR) systems. The issue was observed as early as September 2024 and remains a concern in 2026. Attackers can leverage this by sending a malicious IOCTL to the ZwTerminateProcess function at the kernel level, effectively removing the security software.

Recommendations Versions prior to 2.0.0.0 should be updated.

Exploit

Fix

Related Identifiers

CVE-2023-52271

Affected Products

Topaz Antifraud

Wsftprm.Sys

References · 12

• 🔥 https://northwave-cybersecurity.com/vulnerability-notice-topaz-antifraud · Exploit
• https://osv.dev/vulnerability/CVE-2023-52271 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52271 · Security Note
• https://twitter.com/VulmonFeeds/status/1744473240427217242 · Twitter Post
• https://twitter.com/CVEnew/status/1744453231059820978 · Twitter Post
• https://twitter.com/wdormann/status/2024834551038750734 · Twitter Post
• https://twitter.com/BriPwn/status/2024597923363962906 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1raoh63/top_10_trending_cves_21022026 · Reddit Post
• https://topazevolution.com/en/antifraud · Note
• https://twitter.com/vict0ni/status/2023308443373690906 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1rbj2n6/top_10_trending_cves_22022026 · Reddit Post
• https://twitter.com/magicswordio/status/2012956796336713913 · Twitter Post