CVE-2025-6217 is an information disclosure vulnerability affecting PEAK-System Device Drivers, specifically within the PCANFD_ADD_FILTERS IOCTL. It stems from a Time-Of-Check Time-Of-Use (TOCTOU) flaw due to improper locking, allowing local attackers with low-privileged code execution to disclose sensitive information. The vulnerability has a low CVSS score of 2.5, indicating a low impact (information disclosure) and high attack complexity, as it requires local access and can be chained with other vulnerabilities for kernel-level arbitrary code execution. Currently, there is no known active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting it is not a widely targeted or publicized threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
8.18.0CPE matchmatch criteria | cpe:2.3:a:peak-system:device_driver:8.18.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.