A vulnerability was found in IObit Protected Folder up to 13

CVE-2025-0223 is a local null-pointer dereference in IURegistryFilter.sys, the IOCTL-handling driver used by IObit Protected Folder. NVD and related records say versions 13.6.0.0 through 13.6.0.5 are affected, and a low-privileged local user can hit IOCTL paths 0x8001E000, 0x8001E00C, 0x8001E004, or 0x8001E010 to crash the vulnerable component. The stated impact is availability only: no confidentiality loss, no integrity loss, and no evidence of privilege escalation from this CVE by itself.

The vendor/CNA MEDIUM 5.5 score is technically fair in CVSS terms but too generous operationally for enterprise patch triage. The decisive friction is attacker position: this requires already being on the box with local authenticated code execution, on a host that also happens to run a fairly niche Windows folder-locking utility. That makes it a post-compromise, single-host disruption issue, not a broad initial-access or lateral-movement accelerator.

Why this verdict

• Requires local authenticated access: this is not remotely reachable; it presumes the attacker is already on the host.
• Implies prior compromise or insider presence: AV:L + PR:L means this is a post-initial-access problem, which sharply narrows real-world exploitability.
• Narrow exposure population: IObit Protected Folder is a niche Windows utility, not a standard enterprise platform or edge service.
• Blast radius is one endpoint at a time: the available impact is denial of service, not credential theft, lateral movement, or domain-wide compromise.
• Threat telemetry is weak: no KEV listing, no confirmed campaigns, and a very low EPSS signal reduce urgency further.

Why not higher?

There is no unauthenticated remote path, no network exposure, and no evidence this bug yields code execution or privilege escalation. Even a successful trigger appears to buy the attacker a crash on an already-accessed machine, which is disruptive but not strategically powerful.

Why not lower?

I did not drop this to IGNORE because it still sits in a kernel-adjacent driver path and can intentionally disrupt business endpoints where the software is installed. If you have this utility on shared kiosks, labs, or sensitive workstation pools, a low-privileged user could weaponize it for noisy disruption.

1. Inventory the product — Use your EDR, software inventory, or SCCM/Intune data to identify hosts with IObit Protected Folder 13.6.0.0-13.6.0.5. For a LOW verdict there is no formal mitigation SLA; treat this as backlog hygiene and finish the inventory during your next normal endpoint review cycle.
2. Rationalize or remove nonstandard endpoint utilities — If Protected Folder is not an approved business dependency, uninstall it from the fleet or keep it out of your gold images. For LOW, this is backlog hygiene rather than emergency work, but software reduction is the most reliable risk removal when no fixed version is clearly published.
3. Harden local code execution — Use WDAC, AppLocker, ASR rules, and strong EDR policy to make it harder for a low-privileged user or commodity malware to run arbitrary local tooling that can hit driver IOCTLs. This does not fix the bug, but it blocks the prerequisite stage that matters most.
4. Watch for crash telemetry on affected hosts — Collect Windows Error Reporting, bugcheck events, abrupt reboots, and recurring faults tied to the product or driver. For a LOW issue this is sufficient monitoring until either the software is removed or a vendor fix becomes available.

Run this on the target Windows host or through your endpoint management tool as a standard software-inventory check. Invoke it with powershell.exe -ExecutionPolicy Bypass -File .\check-CVE-2025-0223.ps1; no admin rights are strictly required for the registry checks, though admin helps if you also want to inspect file versions under protected paths.

# check-CVE-2025-0223.ps1

# Detects vulnerable IObit Protected Folder versions for CVE-2025-0223.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-InstalledProtectedFolderVersion {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    foreach ($path in $paths) {
        try {
            $items = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue |
                Where-Object {
                    ($_.DisplayName -match '^Protected Folder($|\s)') -or
                    ($_.DisplayName -match '^IObit Protected Folder($|\s)')
                }

            foreach ($item in $items) {
                if ($item.DisplayVersion) {
                    return [string]$item.DisplayVersion
                }
            }
        } catch {
            # continue

        }
    }

    $candidateFiles = @(
        'C:\Program Files\IObit\Protected Folder\ProtectedFolder.exe',
        'C:\Program Files (x86)\IObit\Protected Folder\ProtectedFolder.exe'
    )

    foreach ($file in $candidateFiles) {
        if (Test-Path $file) {
            try {
                $ver = (Get-Item $file).VersionInfo.ProductVersion
                if ($ver) { return [string]$ver }
            } catch {
                # continue

            }
        }
    }

    return $null
}

function Compare-Version {
    param(
        [Parameter(Mandatory=$true)][string]$A,
        [Parameter(Mandatory=$true)][string]$B
    )

    try {
        $va = [version]$A
        $vb = [version]$B
        return $va.CompareTo($vb)
    } catch {
        return $null
    }
}

try {
    $version = Get-InstalledProtectedFolderVersion

    if (-not $version) {
        Write-Output 'PATCHED: IObit Protected Folder not found (not affected on this host).'
        exit 0
    }

    $lower = '13.6.0.0'
    $upper = '13.6.0.5'

    $cmpLower = Compare-Version -A $version -B $lower
    $cmpUpper = Compare-Version -A $version -B $upper

    if ($null -eq $cmpLower -or $null -eq $cmpUpper) {
        Write-Output ("UNKNOWN: Found IObit Protected Folder version '{0}', but version parsing failed." -f $version)
        exit 2
    }

    if ($cmpLower -ge 0 -and $cmpUpper -le 0) {
        Write-Output ("VULNERABLE: IObit Protected Folder version {0} is within affected range 13.6.0.0-13.6.0.5 for CVE-2025-0223." -f $version)
        exit 1
    }

    if ($cmpUpper -gt 0) {
        Write-Output ("PATCHED: IObit Protected Folder version {0} is newer than 13.6.0.5." -f $version)
        exit 0
    }

    Write-Output ("UNKNOWN: Found IObit Protected Folder version {0}; unable to classify confidently." -f $version)
    exit 2
} catch {
    Write-Output ("UNKNOWN: Detection failed with error: {0}" -f $_.Exception.Message)
    exit 2
}

Sources

1. NVD CVE record
2. Positive Technologies dbugs entry
3. Vulners CVE page
4. OpenCVE record
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. IObit FAQ for Protected Folder
8. IObit Protected Folder manual