IObit Protected Folder IURegistryFilter.sys IOCTL null pointer dereference

# check-CVE-2025-0223.ps1

# Detects vulnerable IObit Protected Folder versions for CVE-2025-0223.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-InstalledProtectedFolderVersion {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    foreach ($path in $paths) {
        try {
            $items = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue |
                Where-Object {
                    ($_.DisplayName -match '^Protected Folder($|\s)') -or
                    ($_.DisplayName -match '^IObit Protected Folder($|\s)')
                }

            foreach ($item in $items) {
                if ($item.DisplayVersion) {
                    return [string]$item.DisplayVersion
                }
            }
        } catch {
            # continue

        }
    }

    $candidateFiles = @(
        'C:\Program Files\IObit\Protected Folder\ProtectedFolder.exe',
        'C:\Program Files (x86)\IObit\Protected Folder\ProtectedFolder.exe'
    )

    foreach ($file in $candidateFiles) {
        if (Test-Path $file) {
            try {
                $ver = (Get-Item $file).VersionInfo.ProductVersion
                if ($ver) { return [string]$ver }
            } catch {
                # continue

            }
        }
    }

    return $null
}

function Compare-Version {
    param(
        [Parameter(Mandatory=$true)][string]$A,
        [Parameter(Mandatory=$true)][string]$B
    )

    try {
        $va = [version]$A
        $vb = [version]$B
        return $va.CompareTo($vb)
    } catch {
        return $null
    }
}

try {
    $version = Get-InstalledProtectedFolderVersion

    if (-not $version) {
        Write-Output 'PATCHED: IObit Protected Folder not found (not affected on this host).'
        exit 0
    }

    $lower = '13.6.0.0'
    $upper = '13.6.0.5'

    $cmpLower = Compare-Version -A $version -B $lower
    $cmpUpper = Compare-Version -A $version -B $upper

    if ($null -eq $cmpLower -or $null -eq $cmpUpper) {
        Write-Output ("UNKNOWN: Found IObit Protected Folder version '{0}', but version parsing failed." -f $version)
        exit 2
    }

    if ($cmpLower -ge 0 -and $cmpUpper -le 0) {
        Write-Output ("VULNERABLE: IObit Protected Folder version {0} is within affected range 13.6.0.0-13.6.0.5 for CVE-2025-0223." -f $version)
        exit 1
    }

    if ($cmpUpper -gt 0) {
        Write-Output ("PATCHED: IObit Protected Folder version {0} is newer than 13.6.0.5." -f $version)
        exit 0
    }

    Write-Output ("UNKNOWN: Found IObit Protected Folder version {0}; unable to classify confidently." -f $version)
    exit 2
} catch {
    Write-Output ("UNKNOWN: Detection failed with error: {0}" -f $_.Exception.Message)
    exit 2
}