Vulnerability Spotlight: Two vulnerabilities in Soft Perfect RAM Disk
Summary: Cisco Talos researchers found two vulnerabilities in the spvve.sys driver of SoftPerfect RAM Disk 4.1: TALOS-2020-1121 (CVE-2020-13522) lets an unprivileged user send a crafted I/O request packet to delete any file on the filesystem, and TALOS-2020-1122 (CVE-2020-13523) uses the same mechanism to disclose sensitive information. Talos worked with SoftPerfect under its coordinated disclosure policy to resolve the issues and make an update available.
Key Takeaway: The file-deletion flaw requires no privileges, so any unprivileged user on a machine running the driver can point it at a specific filepath and remove that file - and the second flaw turns the same driver into a channel for exposing sensitive data.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-13522CVE-2020-13523
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026