{“lastseen”:”2025-08-11T16:26:28″,”description”:”Titles: Microsoft Windows – Storage QoS Filter Driver Checker…”,”published”:”2025-08-11T00:00:00″,”modified”:”2025-08-11T00:00:00″,”type”:”exploitdb”,”title”:”Microsoft Windows – Storage QoS Filter Driver Checker”,”source”:””,”references”:””,”id”:”EDB-ID:52399″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-49730″],”sourceData”:”# Titles: Microsoft Windows – Storage QoS Filter Driver Checker\\r\\n# Author: nu11secur1ty\\r\\n# Date: 08\/04\/2025\\r\\n# Vendor: Microsoft\\r\\n# Software: https:\/\/www.microsoft.com\/en-us\/software-download\/windows11\\r\\n# Reference:\\r\\nhttps:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-49730\\r\\n\\r\\n## Description\\r\\nThis PowerShell script checks if your Windows system is vulnerable to\\r\\n**CVE-2025-49730**, a critical vulnerability in the `storqosflt.sys`\\r\\nStorage QoS Filter Driver.\\r\\n\\r\\n## Features\\r\\n\\r\\n- Detects if the `storqosflt` driver is present.\\r\\n- Retrieves the driver version and compares it against the known patched\\r\\nversion (`10.0.26100.1`).\\r\\n- Verifies the driver’s digital signature to ensure authenticity.\\r\\n- Calculates the SHA-256 hash of the driver file for integrity verification.\\r\\n- Retrieves recent system event logs related to `storqosflt` to identify\\r\\nsuspicious or unusual activity.\\r\\n\\r\\n## Usage\\r\\n\\r\\n1. Open PowerShell with Administrator privileges.\\r\\n2. Run the script:\\r\\n\\r\\n “`powershell\\r\\n .\\\\Check-StorQoS-CVE2025.ps1\\r\\n “`\\r\\n\\r\\n3. Review the output:\\r\\n\\r\\n – **Red messages** indicate vulnerable or suspicious conditions (e.g.,\\r\\nvulnerable driver version or invalid digital signature).\\r\\n – **Yellow messages** indicate warnings or missing data.\\r\\n – **Green messages** indicate good or safe status.\\r\\n\\r\\n## Requirements\\r\\n\\r\\n- Windows PowerShell (tested on Windows 10 and 11).\\r\\n- Execution policy set to allow running local scripts (`Set-ExecutionPolicy\\r\\nRemoteSigned` may be needed).\\r\\n- Administrator privileges recommended for full access to driver info and\\r\\nlogs.\\r\\n\\r\\n## Disclaimer\\r\\n\\r\\nThis script **does not** attempt to exploit the vulnerability. It only\\r\\nchecks system status to **prove** vulnerability presence or absence based\\r\\non driver version, signature, and logs.\\r\\n\\r\\n## Contact\\r\\n\\r\\nFor questions or improvements, please open an issue or contact the author.\\r\\n\\r\\n\\r\\n# Source:\\r\\n[href](\\r\\nhttps:\/\/github.com\/nu11secur1ty\/Windows11Exploits\/tree\/main\/2025\/CVE-2025-49730\\r\\n)\\r\\n\\r\\n\\r\\n# Buy me a coffee if you are not ashamed:\\r\\n[href](https:\/\/www.paypal.com\/donate\/?hosted_button_id=ZPQZT5XMC5RFY)\\r\\n\\r\\n\\r\\n# Source download\\r\\n[href](\\r\\nhttps:\/\/nu11secur1ty.github.io\/DownGit\/#\/home?url=https:\/\/github.com\/nu11secur1ty\/Windows11Exploits\/tree\/main\/2025\/CVE-2025-49730\\r\\n)\\r\\n\\r\\n# Time spent:\\r\\n01:35:00\\r\\n\\r\\n\\r\\n– \\r\\nSystem Administrator – Infrastructure Engineer\\r\\nPenetration Testing Engineer\\r\\nExploit developer at https:\/\/packetstormsecurity.com\/\\r\\nhttps:\/\/cve.mitre.org\/index.html\\r\\nhttps:\/\/cxsecurity.com\/ and https:\/\/www.exploit-db.com\/\\r\\n0day Exploit DataBase https:\/\/0day.today\/\\r\\nhome page: https:\/\/www.nu11secur1ty.com\/\\r\\nhiPEnIMR0v7QCo\/+SEH9gBclAAYWGnPoBIQ75sCj60E=\\r\\n nu11secur1ty \\u003chttp:\/\/nu11secur1ty.com\/\\u003e\\r\\n\\r\\n– \\r\\n\\r\\nSystem Administrator – Infrastructure Engineer\\r\\nPenetration Testing Engineer\\r\\nExploit developer at https:\/\/packetstorm.news\/\\r\\nhttps:\/\/cve.mitre.org\/index.html\\r\\nhttps:\/\/cxsecurity.com\/ and https:\/\/www.exploit-db.com\/\\r\\n0day Exploit DataBase https:\/\/0day.today\/\\r\\nhome page: https:\/\/www.nu11secur1ty.com\/\\r\\nhiPEnIMR0v7QCo\/+SEH9gBclAAYWGnPoBIQ75sCj60E=\\r\\n nu11secur1ty \\u003chttp:\/\/nu11secur1ty.com\/\\u003e”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52399″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52399″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-11T16:26:28″,”description”:”Titles: Microsoft Windows – Storage QoS Filter Driver Checker…”,”published”:”2025-08-11T00:00:00″,”modified”:”2025-08-11T00:00:00″,”type”:”exploitdb”,”title”:”Microsoft Windows – Storage QoS Filter Driver Checker”,”source”:””,”references”:””,”id”:”EDB-ID:52399″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-49730″],”sourceData”:”# Titles: Microsoft Windows – Storage QoS Filter Driver Checker\\r\\n#…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,40,15,13,7,11,5],"class_list":["post-10366","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n