CVE Alert: CVE-2025-5555 – Nixdorf Wincor – PORT IO Driver

Risk verdict

High risk due to a publicly disclosed, local, low-privilege exploit; patching should be treated as a top priority.

Why this matters

A stack-based buffer overflow in the IOCTL Handler can lead to kernel-level memory corruption and remote code execution on affected devices. In environments using the PORT IO Driver (e.g., POS/ATM or retail kiosks on Windows), exploitation could disrupt operations, enable data exposure, or permit authorisation bypass, with tangible business impact.

Most likely attack path

Exploitation requires local access and low privileges; an attacker would target the IOCTL interface exposed by wnport.sys sub_11100. Successful overflow could grant code execution with high privilege and potential system compromise. Lateral movement is limited by the local-access requirement, but a single compromised device could serve as a foothold for a larger target.

Who is most exposed

Devices and deployments that rely on the Nixdorf Wincor PORT IO Driver in Windows-based retail, banking, or kiosk environments are most at risk, especially where physical access cannot be tightly controlled.

Detection ideas

• Kernel crash dumps or bluescreens referencing wnport.sys or sub_11100.
• Unusual IOCTL activity to the PORT IO Driver, especially near localized access events.
• Public-exploit indicators in logs or memory dumps showing buffer overflow patterns.
• Erratic memory corruption symptoms during driver calls.

Mitigation and prioritisation

• Apply patch to 3.0.0.1; verify compatibility and deploy rapidly.
• If patching is delayed, restrict local access to affected devices and segment kiosks/POS endpoints.
• Enforce strict access controls around devices with the driver; implement least privilege for processes invoking IOCTLs.
• Monitor for kernel instability signals and collect targeted memory crash data for rapid triage.
• Update change-management tickets with evidence of exploitation likelihood and remediation steps. If KEV or EPSS data later indicate heightened urgency, elevate accordingly.