BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based on header bytes. An authenticated attacker could encrypt files, preserving the first four bytes and preventing this particular method from triggering. The affected product implements additional integrity-based detection mechanisms capable of identifying file corruption or encryption for some common file extensions independent of header bytes. As a result, this vulnerability does not represent a complete bypass of ransomware detection, but a limitation of one detection method when evaluated independently. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected. BullWall plans to improve detection method documentation.
References
| Link | Resource |
|---|---|
| https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-352-01.json | Broken Link |
| https://www.cve.org/CVERecord?id=CVE-2025-62000 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Jan 2026, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based on header bytes. An authenticated attacker could encrypt files, preserving the first four bytes and preventing this particular method from triggering. The affected product implements additional integrity-based detection mechanisms capable of identifying file corruption or encryption for some common file extensions independent of header bytes. As a result, this vulnerability does not represent a complete bypass of ransomware detection, but a limitation of one detection method when evaluated independently. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected. BullWall plans to improve detection method documentation. |
12 Jan 2026, 17:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Bullwall ransomware Containment
Bullwall |
|
| References | () https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/VA-25-352-01.json - Broken Link | |
| References | () https://www.cve.org/CVERecord?id=CVE-2025-62000 - Third Party Advisory | |
| CPE | cpe:2.3:a:bullwall:ransomware_containment:4.6.0.7:*:*:*:*:*:*:* cpe:2.3:a:bullwall:ransomware_containment:4.6.0.6:*:*:*:*:*:*:* cpe:2.3:a:bullwall:ransomware_containment:4.6.1.4:*:*:*:*:*:*:* cpe:2.3:a:bullwall:ransomware_containment:4.6.0.0:*:*:*:*:*:*:* |
18 Dec 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-18 21:15
Updated : 2026-01-14 22:15
NVD link : CVE-2025-62000
Mitre link : CVE-2025-62000
CVE.ORG link : CVE-2025-62000
JSON object : View
Products Affected
bullwall
- ransomware_containment
CWE
CWE-1023
Incomplete Comparison with Missing Factors