Cracking the Shell: CVE-2025-7433 Local Privilege Escalation in Sophos Intercept X for Windows

Introduction

CVE-2025-7433 is a high-severity flaw in Sophos Intercept X for Windows with Central Device Encryption, and it turns an endpoint security product into a tool for attackers. Any local user, or malware with a foothold, can use it to escalate privileges and run arbitrary code as SYSTEM. That effectively bypasses all endpoint security controls and could expose sensitive data or disable encryption entirely.

About Sophos: Sophos sells endpoint security to hundreds of thousands of organizations and protects millions of endpoints worldwide. Intercept X is its flagship suite. It is widely deployed in enterprises and SMBs alike and known for advanced threat protection and device encryption. Because the product is so widespread, a vulnerability in it reaches business, government, and critical infrastructure.

Technical Information

CVE-2025-7433 is a deserialization of untrusted data vulnerability (CWE-502) in Sophos Intercept X for Windows with Central Device Encryption, affecting versions prior to 2025.1 (NVD, Sophos Advisory). The encryption service processes serialized input, such as configuration data, policy objects, or inter-process messages, without proper validation or type checking.

A local attacker, or malware running as a low-privileged user, can supply a crafted serialized payload to the vulnerable service, and the service deserializes it without sufficient safeguards. The result is arbitrary code execution as SYSTEM, the highest privilege level on Windows. The attacker needs no administrative rights to start the attack, only local access to the endpoint.

Attack Vector:

• The attacker needs local access, through a compromised user account or malware already present on the system.
• The attacker crafts a malicious .NET serialization payload (for example, with a known gadget chain such as TypeConfuseDelegate) and aims it at the vulnerable deserialization routine in the encryption service.
• When the service processes the payload, potentially during a policy reload, a configuration update, or IPC, the malicious code runs with SYSTEM privileges.

Key Technical Points:

• Deserialization of untrusted data (CWE-502) is a well-known class of vulnerability, and it is especially dangerous in services that run with high privileges.
• The flaw is not remotely exploitable. It requires local access.
• A successful exploit lets the attacker run any code as SYSTEM, including code that disables security controls, extracts keys, or installs persistent malware.

As of this writing, no vulnerable code snippets or detailed PoC are publicly available. The vulnerability is confirmed to be in the deserialization logic of the Central Device Encryption component.

Patch Information

Sophos has fixed CVE-2025-7433, along with related LPE vulnerabilities, in these versions:

• Intercept X for Windows FTS 2024.3.2 and newer
• Intercept X for Windows LTS 2024.1.1.50 and newer

Customers on the default update policy receive these updates automatically. Systems on older or unsupported versions need a manual upgrade. After updating, check the installed version in the Sophos Central Admin Console to confirm the fix is in place.

Reference: Sophos Security Advisory

Affected Systems and Versions

• Product: Sophos Intercept X for Windows with Central Device Encryption
• Affected Versions: All versions prior to 2025.1
• Fixed Versions:
  • Intercept X for Windows FTS 2024.3.2 and newer
  • Intercept X for Windows LTS 2024.1.1.50 and newer
• Vulnerable Configurations: Any deployment running a version older than those listed above, regardless of update channel or policy.

Vendor Security History

Sophos has fixed similar vulnerabilities in its encryption modules before, including CVE-2024-8885, an arbitrary file write that also led to privilege escalation. The vendor has a strong track record of responsible disclosure. It works with external researchers and releases patches on time, typically within industry-standard response windows. Sophos credits researchers publicly and keeps detailed advisories for transparency.

References

• NVD Entry for CVE-2025-7433
• Sophos Security Advisory: sophos-sa-20250717-cix-lpe
• CWE-502: Deserialization of Untrusted Data
• Sophos Advisory for CVE-2024-8885

Source: This report was created using AI

If you have suggestions for improvement or feedback, email us at [email protected]