CVE-2025-62002 BullWall Ransomware Containment file count detection bypass
An authenticated attacker can bypass ransomware detection by encrypting a single large file, evading file-count based triggers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62002?
CVE-2025-62002 is a medium-severity vulnerability in BullWall Ransomware Containment, published on 18 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large) file without triggering detection if thresholds are configured to require multiple file changes. The number of files to trigger detection can be configured by the user. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected.
Weakness: CWE-358
Which versions are affected by CVE-2025-62002?
It affects 1 product.
Products include Bullwall Ransomware Containment.
How do I fix CVE-2025-62002?
No fix has been published for CVE-2025-62002 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-62002 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-62002 exists.
Other vulnerabilities in BullWall Ransomware Containment
Sources
Also known as GHSA-q863-2f3f-cf77.