{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "BullWall Ransomware Containment and Server Intrusion Protection multiple vulnerabilities",
    "tracking": {
      "current_release_date": "2025-12-18T00:00:00Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.11.0"
        }
      },
      "id": "VA-25-352-01",
      "initial_release_date": "2025-12-18T00:00:00Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2025-12-18T00:00:00Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "BullWall Ransomware Containment and Server Intrusion Protection are products used for ransomware containment. Multiple vulnerabilities were reported that when used individually or in conjunction could allow a remote attacker with valid credentials to log in to a system with BullWall products and bypass ransomware detection. ",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Contact BullWall.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "Denmark",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-352-01.json",
        "summary": "Vulnerability Advisory VA-25-352-01 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "BullWall",
        "branches": [
          {
            "category": "product_name",
            "name": "Ransomware Containment",
            "branches": [
              {
                "category": "product_version_range",
                "name": ">4.6.0.0",
                "product": {
                  "name": "BullWall Ransomware Containment >4.6.0.0",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=4.6.0.0|<4.6.1.14",
                "product": {
                  "name": "BullWall Ransomware Containment >=4.6.0.0|<4.6.1.14",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=4.6.0.0|<5.0.0.42",
                "product": {
                  "name": "BullWall Ransomware Containment >=4.6.0.0|<5.0.0.42",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "4.6.1.14",
                "product": {
                  "name": "BullWall Ransomware Containment 4.6.1.14",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version",
                "name": "5.0.0.42",
                "product": {
                  "name": "BullWall Ransomware Containment 5.0.0.42",
                  "product_id": "CSAFPID-0005"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "Server Intrusion Protection",
            "branches": [
              {
                "category": "product_version_range",
                "name": ">4.6.0.0",
                "product": {
                  "name": "BullWall Server Intrusion Protection >4.6.0.0",
                  "product_id": "CSAFPID-0006"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-62000",
      "cwe": {
        "id": "CWE-1023",
        "name": "Incomplete Comparison with Missing Factors"
      },
      "notes": [
        {
          "category": "summary",
          "text": "BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based on header bytes. An authenticated attacker could encrypt files, preserving the first four bytes and preventing this particular method from triggering. The affected product implements additional integrity-based detection mechanisms capable of identifying file corruption or encryption for some common file extensions independent of header bytes. As a result, this vulnerability does not represent a complete bypass of ransomware detection, but a limitation of one detection method when evaluated independently. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected. BullWall plans to improve detection method documentation.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2025-12-18T19:55:52Z/"
        }
      ],
      "title": "BullWall Ransomware Containment incomplete file inspection",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-352-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62000"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "BullWall plans to improve detection method documentation.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Alexander Nikolaj Fischer"
          ]
        }
      ],
      "release_date": "2025-12-18T00:00:00Z"
    },
    {
      "cve": "CVE-2025-62001",
      "cwe": {
        "id": "CWE-420",
        "name": "Unprotected Alternate Channel"
      },
      "notes": [
        {
          "category": "summary",
          "text": "BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which remove hardcoded exclusion behavior and exposes exclusion handling as configurable settings.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:N/T:T/2025-12-18T19:54:33Z/"
        }
      ],
      "title": "BullWall Ransomware Containment hard-coded folder exclusions",
      "product_status": {
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0003"
        ],
        "fixed": [
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-352-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62001"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 4.6.1.14 and 5.0.0.42.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 4.6.1.14 and 5.0.0.42.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 4.6.1.14 and 5.0.0.42.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 4.6.1.14 and 5.0.0.42.",
          "product_ids": [
            "CSAFPID-0005"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Alexander Nikolaj Fischer"
          ]
        }
      ],
      "release_date": "2025-12-18T00:00:00Z"
    },
    {
      "cve": "CVE-2025-62002",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "notes": [
        {
          "category": "summary",
          "text": "BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large) file without triggering detection if thresholds are configured to require multiple file changes. The number of files to trigger detection can be configured by the user. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:P/A:Y/T:P/2025-10-06T19:36:16Z/"
        }
      ],
      "title": "BullWall Ransomware Containment file count detection bypass",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-352-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62002"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "No fix available.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Alexander Nikolaj Fischer"
          ]
        }
      ],
      "release_date": "2025-12-18T00:00:00Z"
    },
    {
      "cve": "CVE-2025-62003",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "summary",
          "text": "BullWall Server Intrusion Protection has a noticeable configuration-dependent delay before the MFA check for RDP connections. A remote, authenticated attacker can potentially bypass detection during this delay. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:T/2025-12-18T19:50:28Z/"
        }
      ],
      "title": "BullWall Server Intrusion Protection RDP MFA connection delay",
      "product_status": {
        "known_affected": [
          "CSAFPID-0006"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-352-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62003"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0006"
          ]
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "No fix available.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Alexander Nikolaj Fischer"
          ]
        }
      ],
      "release_date": "2025-12-18T00:00:00Z"
    },
    {
      "cve": "CVE-2025-62004",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "notes": [
        {
          "category": "summary",
          "text": "BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attacker can log in after boot and before SIP MFA is running. The SIP services do not retroactively enforce MFA or disconnect sessions that were not subject to SIP MFA. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions mayy also be affected. BullWall plans to improve detection method documentation.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:T/2025-12-18T19:52:16Z/"
        }
      ],
      "title": "BullWall Server Intrusion Protection (SIP) initialization race condition",
      "product_status": {
        "known_affected": [
          "CSAFPID-0006"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-352-01.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62004"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0006"
          ]
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "No fix available.",
          "product_ids": [
            "CSAFPID-0006"
          ]
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Alexander Nikolaj Fischer"
          ]
        }
      ],
      "release_date": "2025-12-18T00:00:00Z"
    }
  ]
}