CVE-2023-52271

MEDIUM

Topaz Antifraud wsftprm.sys Kernel Driver Process Termination

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-52271 has a selected CVSS score of 6.5 (medium); EIP currently links 1 repository PoC.

Description

The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via an IOCTL (which will be named at a later time).

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 16, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 9, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

antifraud

Browse topazevolution / antifraud
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubvictoni/BYOVD-CVE-2023-52271-POCRepository PoCby victoni10Exploit2 files

4.7 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

C++ exploit for CVE-2023-52271 that opens a handle to the vulnerable wsftprm.sys driver via payload withheld, sends IOCTL payload withheld with a target PID to terminate Protected Process Light (PPL) processes, and continuously scans for and kills a hardcoded list of Microsoft Defender and security processes.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward C++ exploit for CVE-2023-52271 that terminates a hardcoded list of security processes via a vulnerable driver. No backdoor, persistence, credential theft, unrelated payload, or concealed operator-directed harm was observed.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesC++
Target softwarewsftprm.sysTopaz AntifraudMicrosoft DefenderWindows Security
Attack typesBYOVDprocess terminationdefense evasion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by opening the driver, sending a crafted IOCTL to terminate processes, and targeting specific security software. It is not a scanner or writeup; it performs the actual exploitation.

README.md:4main.cpp:94-102main.cpp:114-132main.cpp:173-186

Requirements

  • The vulnerable wsftprm.sys driver must be loaded on the target system.README.md:4
  • The attacker must have sufficient privileges to open a handle to the driver device payload withheld.main.cpp:94-102

Observed behavior

  • Opens a handle to the vulnerable driver via CreateFileW on payload withheld.main.cpp:94-102
  • Sends IOCTL payload withheld with a 1036-byte buffer containing the target PID in the first 4 bytes to terminate a process.main.cpp:114-132
  • Continuously enumerates running processes and terminates any matching a hardcoded list of Microsoft Defender and security executables.main.cpp:26-53main.cpp:173-186
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Process List
Payload withheldThe exploit targets Microsoft Defender and related security processes, consistent with the stated purpose of killing AV/EDR processes.main.cpp:26-53
Driver Device Path
Payload withheldThe PoC opens a handle to the Warsaw_PM device, which is associated with the vulnerable wsftprm.sys driver, matching the CVE description.main.cpp:94-95
Ioctl Code
Payload withheldThe IOCTL code used to trigger the process termination in the vulnerable driver.main.cpp:123-125
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md and main.cpp) were reviewed; no binary files were present in the evidence.
  • The review does not assess the safety or correctness of the exploit code, only the presence of backdoor or deceptive behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3