BullWall Ransomware Containment file count detection bypass
Priority MEDIUM 63CWE-358Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large) file without triggering detection if thresholds are configured to require multiple file changes. The number of files to trigger detection can be configured by the user. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BullWall | Ransomware Containment | 4.6.0.0 and later | — | No fix listed | CNA |
- Ransomware Containment VendorBullWall Affected 4.6.0.0 and later Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bullwall:ransomware_containment:4.6.0.0:*:*:*:*:*:*:* | 4.6.0.0 | Vulnerable | BullWall |
| cpe:2.3:a:bullwall:ransomware_containment:4.6.0.6:*:*:*:*:*:*:* | 4.6.0.6 | Vulnerable | BullWall |
| cpe:2.3:a:bullwall:ransomware_containment:4.6.0.7:*:*:*:*:*:*:* | 4.6.0.7 | Vulnerable | BullWall |
| cpe:2.3:a:bullwall:ransomware_containment:4.6.1.4:*:*:*:*:*:*:* | 4.6.1.4 | Vulnerable | BullWall |
- cpe:2.3:a:bullwall:ransomware_containment:4.6.0.0:*:*:*:*:*:*:* Versions 4.6.0.0 Vulnerable ·BullWall
- cpe:2.3:a:bullwall:ransomware_containment:4.6.0.6:*:*:*:*:*:*:* Versions 4.6.0.6 Vulnerable ·BullWall
- cpe:2.3:a:bullwall:ransomware_containment:4.6.0.7:*:*:*:*:*:*:* Versions 4.6.0.7 Vulnerable ·BullWall
- cpe:2.3:a:bullwall:ransomware_containment:4.6.1.4:*:*:*:*:*:*:* Versions 4.6.1.4 Vulnerable ·BullWall
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-62002
- 2026-10-03 Alias added: GHSA-q863-2f3f-cf77
More BullWall Ransomware Containment vulnerabilities
- TI-2025-38324 BullWall Ransomware Containment hard-coded folder exclusions CVSS 4.0HIGH 8.7
- TI-2025-38323 BullWall Ransomware Containment incomplete file inspection CVSS 4.0MEDIUM 6.9
Sources
- CVE-2025-62002 · CVE Program
- CVE-2025-62002 · NVD
- FIRST EPSS
- GHSA-q863-2f3f-cf77 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences