AOMEI Backupper driver flaw enables UEFI bypass
A world-writable kernel driver in AOMEI Backupper 8.4.0 lets local unprivileged users write raw disk sectors and plant malicious UEFI code, bypassing HVCI, EDR, and BitLocker protections.
CERT/CC has published an advisory (VU#687587) for CVE-2026-12780, an incorrect permission assignment vulnerability (CWE-732) in the amwrtdrv.sys kernel driver bundled with AOMEI Backupper 8.4.0. The driver exposes a device object (\\.\mwrtdrv\DISK0) without a security descriptor, meaning any unprivileged local process can open it and issue arbitrary write commands to physical disks. An attacker can abuse this to write to the pre-partition gap (LBA 34-2047), inject a malicious UEFI payload, and modify the GPT to point to it as an EFI System Partition, achieving code execution during the UEFI Boot Device Selection phase — before the OS or any of its security controls load.
The practical impact is significant for endpoints where Secure Boot is disabled: attackers can bypass Hyper-V Code Integrity, EDR agents, and Windows Defender entirely, since the payload runs pre-OS. On systems using BitLocker with TPM-only protection (no PIN), this also opens an evil-maid attack path to capture the Volume Master Key during pre-boot. There is no indication in the advisory of in-the-wild exploitation; this is a vulnerability disclosure requiring local access, credited to researcher SiCk / afflicted.sh.
Defenders running AOMEI Backupper 8.4.0 should update to a patched version once available from AOMEI that corrects the driver's access controls. Interim mitigations include uninstalling AOMEI Backupper, or disabling the amwrtdrv.sys service (setting its start type from AUTO_START to disabled). Enabling Secure Boot provides defense-in-depth by requiring signed bootloaders but does not fix the underlying driver flaw, and BitLocker should be configured with a PIN/TPM+PIN rather than TPM-only where feasible to reduce evil-maid exposure.
Mentioned in this report
Detection guidance
Suspicious Write to Physical Disk via Vulnerable AOMEI Driver
Detects unprivileged process opening the vulnerable amwrtdrv.sys device object and issuing raw disk write commands to physical disk, enabling UEFI bootkit injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Write to Physical Disk via Vulnerable AOMEI Driver
description: Detects attempts to open and write to the \\?\GLOBALROOT\Device\mwrtdrv\DISK0
device object exposed by vulnerable AOMEI Backupper amwrtdrv.sys driver. This behaviour
is consistent with pre-partition gap UEFI payload injection attacks.
tags:
- attack.persistence
- attack.defense-evasion
- attack.t1542.005
- attack.t1542.003
- attack.t1068
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \\?\GLOBALROOT\Device\mwrtdrv
- \\Device\mwrtdrv
Image|endswith:
- .exe
- .dll
filter_aomei_service:
Image|contains: AOMEI
condition: selection and not filter_aomei_service
falsepositives:
- AOMEI Backupper maintenance and backup tasks during normal operation
level: critical
id: dd1ac897-e9e8-5c35-bd67-784992fc8f43
status: experimental
author: Vorant
Amwrtdrv.sys Service Auto-Start Enabled
Detects when the vulnerable amwrtdrv.sys kernel driver service is configured to auto-start, leaving the unprivileged device endpoint exposed. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Amwrtdrv.sys Service Auto-Start Enabled
description: Detects registry modification setting the amwrtdrv.sys service start
type to AUTO_START or BOOT_START. Vulnerable versions expose the device object without
security descriptors, allowing unprivileged UEFI bootkit injection.
tags:
- attack.persistence
- attack.t1542.003
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith:
- Services\amwrtdrv\Start
- Services\mwrtdrv\Start
Details:
- '0'
- '2'
condition: selection
falsepositives:
- AOMEI Backupper installer or update enabling the driver service
level: high
id: ef53dab0-582b-5d0d-b8c6-20b84194698d
status: experimental
author: Vorant
Unprivileged Process Accessing Vulnerable AOMEI Kernel Driver Device Object
Detects non-system processes opening the amwrtdrv.sys device object without elevated privileges, exploiting CWE-732 incorrect permission assignment for disk write access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unprivileged Process Accessing Vulnerable AOMEI Kernel Driver Device Object
description: Detects CreateFile/CreateFileW calls targeting the \\?\GLOBALROOT\Device\mwrtdrv
device object from non-SYSTEM processes. The vulnerable AOMEI Backupper 8.4.0 driver
exposes this device without a security descriptor, allowing any unprivileged process
to issue arbitrary disk writes.
tags:
- attack.privilege-escalation
- attack.defense-evasion
- attack.t1068
- attack.t1542.005
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- mwrtdrv
- DISK0
- \\?\GLOBALROOT\Device
User|endswith:
- BUILTIN\Users
- BUILTIN\Interactive
filter_aomei_backup:
ParentImage|contains: AOMEI
condition: selection and not filter_aomei_backup
falsepositives:
- Legitimate AOMEI Backupper backup or restore operations under standard user context
level: high
id: 3daea80b-3f96-5494-b34a-55f8b4114ab1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/687587
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free