Qualcomm Chipset Vulnerability Allows RCE
Multi-Component Qualcomm Vulnerabilities
Continue ReadingFirmware
Vulnerabilities in IP-KVMs from 4 Vendors; Risk for Unauthenticated Root Access
Severe vulnerabilities found in IP KVM may allow unauthenticated hackers to gain root access or run malicious code on them. These vulnerabilities have CVSS scores ranging from 3.1 to 9.8.
There are great risks associated as a low-cost device have the ability to provide insiders and hackers unusually broad powers in networks that are often not so secured or vulnerable. Recently researchers from security firm Eclypsium disclosed a total of nine vulnerabilities in IP KVMs from four manufacturers.
IP-KVMs
When a device sell for $30 to $100, are known as IP KVMs. Administrators often use them to remotely access machines on networks. The devices, not much bigger than a deck of cards, allow the machines to be accessed at the BIOS/UEFI level, the firmware that runs before the loading of the operating system.
Risk Associated with IP KVM
If hackers get hands of they might misuse capabilities even in a secured network. Risks are posed when the devices are exposed to the web or internet—are deployed with weak security configurations or surreptitiously connected to by insiders. Firmware vulnerabilities also leave them open to remote takeover.
Its easy for attackers to manipulate device behavior by overwriting configuration files or system binaries, by an attacker can manipulate the device’s behavior. subsequently gain unauthorized access and use the KVM as a pivot point to compromise any target machine connected to it.
“These are not exotic zero-days requiring months of reverse engineering,” Eclypsium researchers Paul Asadoorian and Reynaldo Vasquez Garcia wrote. “These are fundamental security controls that any networked device should implement. Input validation. Authentication. Cryptographic verification. Rate limiting. We are looking at the same class of failures that plagued early IoT devices a decade ago, but now on a device class that provides the equivalent of physical access to everything it connects to.”
Analysis:
The vulnerabilities are catalogued as CVE-2026-32290, CVE-2026-32291, CVE-2026-32292, CVE-2026-32293, CVE-2026-32294, CVE-2026-32295, CVE-2026-32296, CVE-2026-32297 and CVE-2026-32298, with CVSS scores ranging from 3.1 to 9.8 and some fixes already in place (for example, JetKVM updates and NanoKVM versions) while others remain unpatched.
The analysis notes that an attacker could inject keystrokes, boot from removable media to bypass protections, circumvent lock screens, or remain undetected by OS-level security software, given the devices’ remote BIOS/UEFI access.
Threat Mitigation
Mitigations include enforcing MFA where supported, isolating KVM devices on a dedicated management VLAN, restricting internet access, monitoring traffic, and keeping firmware up-to-date, according to Eclypsium.
This vulnerability alone dictates the term immediate network isolation of any deployed Angeet ES3 device.
Requirement of Robust firmware validation and strong access controls
For robust Firmware validation, testing is must but here testing do not imply checking if the coding is working or not. Instead it is a systematic process of assessing whether firmware meets the defined specifications and quality standards.
We have BI and Data Analytics to redefined outcomes of testing and are measured, with key performance indicators (KPIs) drawn from vast amounts of operation data stored in testing logs and real-time deployment environments.
TP-Link Security Update, Omada Gateway Exploits Fixed in October Release
Summary: TP-Link’s October 2025 security updates fixes 4 vulnerabilities in its Omada Gateway devices, including multiple models commonly used in business networks.
| OEM | TP-Link |
| Severity | Critical |
| CVSS Score | 9.3 |
| CVEs | CVE-2025-6541, CVE-2025-6542, CVE-2025-7850, CVE-2025-7851 |
| Date of Announcement | 2025-10-21 |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview:
The vulnerabilities allow attackers to execute remote commands, even without authentication, potentially compromising systems. Some vulnerabilities also let authenticated users inject commands or gain root access, which could lead to traffic interception, configuration changes or malware installation. Security teams are advised to update firmware immediately, review network configurations and change passwords to reduce the risk of exploitation.
| Vulnerability Name | CVE ID | Product Affected | Severity | CVSS Score |
| OS Command Injection Vulnerability | CVE-2025-6542 | TP-Link Omada Gateways | Critical | 9.3 |
| Command Injection Vulnerability | CVE-2025-7850 | TP-Link Omada Gateways | Critical | 9.3 |
Technical Summary:
TP-Link Omada Gateways allows attackers to run arbitrary commands. The most critical one, CVE-2025-6542, a remote attacker can take full control of the device without logging in through the web interface. Another one allows logged-in users to inject commands and gain root access. The issues show the risks of exposed management portals. TP-Link recommends updating firmware, limiting network access and monitoring systems for any signs of attack.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-6542 | TP-Link Omada Gateways (ER605, ER7206, ER8411 & Others) | Unauthenticated remote attackers can execute arbitrary OS commands on the device | Remote Code Execution, System Compromise, Malware Deployment |
| CVE-2025-7850 | TP-Link Omada Gateways (ER7412-M2, ER7212PC, & Others) | Command injection exploitable after admin authentication on the web portal | System Compromise, Root-Level Control |
Additional Vulnerabilities:
The following high-severity vulnerabilities were also addressed in October 2025 TP-Link security updates for Omada Gateways –
| Vulnerability Name | CVE ID | Affected Component | Severity |
| Authenticated Arbitrary OS Command Execution in Omada Gateways | CVE-2025-6541 | TP-Link Omada Gateways | High |
| Root Shell Access Under Restricted Conditions in Omada Gateways | CVE-2025-7851 | TP-Link Omada Gateways | High |
Remediation:
Install the October 2025 firmware updates immediately via the TP-Link support portal to mitigate risks. Here is the below table with the updated version information for the models.
| Model | Affected Versions | Fixed Version |
| ER8411 | < 1.3.3 Build 20251013 Rel.44647 | >= 1.3.3 Build 20251013 Rel.44647 |
| ER7412-M2 | < 1.1.0 Build 20251015 Rel.63594 | >= 1.1.0 Build 20251015 Rel.63594 |
| ER707-M2 | < 1.3.1 Build 20251009 Rel.67687 | >= 1.3.1 Build 20251009 Rel.67687 |
| ER7206 | < 2.2.2 Build 20250724 Rel.11109 | >= 2.2.2 Build 20250724 Rel.11109 |
| ER605 | < 2.3.1 Build 20251015 Rel.78291 | >= 2.3.1 Build 20251015 Rel.78291 |
| ER706W | < 1.2.1 Build 20250821 Rel.80909 | >= 1.2.1 Build 20250821 Rel.80909 |
| ER706W-4G | < 1.2.1 Build 20250821 Rel.82492 | >= 1.2.1 Build 20250821 Rel.82492 |
| ER7212PC | < 2.1.3 Build 20251016 Rel.82571 | >= 2.1.3 Build 20251016 Rel.82571 |
| G36 | < 1.1.4 Build 20251015 Rel.84206 | >= 1.1.4 Build 20251015 Rel.84206 |
| G611 | < 1.2.2 Build 20251017 Rel.45512 | >= 1.2.2 Build 20251017 Rel.45512 |
| FR365 | < 1.1.10 Build 20250626 Rel.81746 | >= 1.1.10 Build 20250626 Rel.81746 |
| FR205 | < 1.0.3 Build 20251016 Rel.61376 | >= 1.0.3 Build 20251016 Rel.61376 |
| FR307-M2 | < 1.2.5 Build 20251015 Rel.76743 | >= 1.2.5 Build 20251015 Rel.76743 |
Here are some recommendations below
- Restrict network access to the management interface and enable trusted networks only.
- Apply least privilege principles and regular security audits for network devices.
- Disable remote management if not required and segment networks to limit lateral movement.
Conclusion:
There is no active exploitation noticed but organizations must prioritize firmware updates to prevent data breaches, malware and intrusions. Security teams should deploy updates immediately, enhance monitoring and implement mitigations to safeguard critical infrastructure.
References:
MediaTek Patches Critical Modem Vulnerabilities
Security Advisory: MediaTek disclosed critical vulnerabilities along with remediation for its modem and system components. Since the vulnerabilities affected thousands of devices, amounting to both multiple high- and medium vulnerabilities that affected, 60 chipsets used in smartphones, routers and IoT devices.
| OEM | MediaTek |
| Severity | High |
| CVSS Score | 8.3 (NOA) |
| CVEs | CVE-2025-20708, CVE-2025-20703, CVE-2025-20704, CVE-2025-20705, CVE-2025-20706, CVE-2025-20707 |
| POC Available | No |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
MediaTek issued a critical security update in September 2025 and key issues include modem-related flaws such as remote code execution, denial of service via rogue base stations and local privilege escalation.
Other vulnerabilities include WLAN buffer overflows, bootloader logic flaws and keymaster information leaks impacting Android devices and OpenWRT/Yocto platforms. There has been no active exploitation noticed and MediaTek began distributing patches to OEMs from July 2025 and urges immediate firmware updates to mitigate the issues.
| Vulnerability Name | CVE ID | Product Affected | Severity |
| Out-of-bounds write in Modem | CVE-2025-20708 | Affected chipsets – 60 chipsets Modem NR15,16,17,17R software versions. | High |
| Out-of-bounds read in Modem | CVE-2025-20703 | Affected chipsets – 57 chipsets Modem NR15,16,17,17R software versions. | High |
| Out-of-bounds write in Modem | CVE-2025-20704 | Affected chipsets – 14 chipsets Modem NR17,17R software versions. | High |
| Use after free in monitor_hang | CVE-2025-20705 | Affected chipsets – 39 chipsets Android 13 – 16, openWRT 19.07, 21.02 / Yocto 2.6 software versions. | Medium |
| Use after free in mbrain | CVE-2025-20706 | Affected chipsets – 5 chipsets Android 14 – 15 software versions. | Medium |
| Use after free in geniezone | CVE-2025-20707 | Affected chipsets – 60 chipsets Android 13 – 15 software versions. | Medium |
Technical Summary
These vulnerabilities primarily include out-of-bounds read and write errors (CWE-125, CWE-787) and use-after-free issues (CWE-416), resulting from improper bounds checking and memory management flaws.
An attacker controlling a rogue base station can exploit these flaws remotely without requiring user interaction, potentially causing remote denial of service, unauthorized privilege escalation, or local privilege escalation if system privileges are already obtained. The exploitation of these vulnerabilities could compromise device stability, security and confidentiality by corrupting memory or executing arbitrary code. Affected devices use modem firmware versions NR15 through NR17R, and a wide spectrum of chipsets, highlighting the broad attack surface.
| CVE ID | Vulnerability Details | Impact |
| CVE-2025-20708 | An out-of-bounds write flaw exists in the Modem due to incorrect bounds checking. This vulnerability allows remote escalation of privilege when a UE connects to a rogue base station, without requiring additional execution privileges or user interaction. | Unauthorized access, data interception, disruption of cellular services |
| CVE-2025-20703 | The Modem is affected by an out-of-bounds read issue caused by improper bounds validation. This can result in remote denial of service if connected to a malicious base station, and exploitation requires no user interaction or extra privileges. | Denial of Service (DoS), modem or device crash, freeze, unresponsiveness |
| CVE-2025-20704 | Due to a missing bounds check, the Modem is vulnerable to an out-of-bounds write. Exploiting this flaw can lead to remote escalation of privilege when connected to a rogue base station, though user interaction is necessary. | Remote privilege escalation, unauthorized elevated access |
| CVE-2025-20705 | A use-after-free condition in the monitor_hang module can cause memory corruption, potentially leading to local escalation of privilege if the attacker already has System-level access. Exploitation does not require user interaction. | Local privilege escalation, memory corruption |
| CVE-2025-20706 | The mbrain component suffers from a use-after-free vulnerability that can result in memory corruption. This may allow local privilege escalation for an attacker with System privileges, without needing user interaction. | Local privilege escalation, memory corruption |
| CVE-2025-20707 | In the geniezone module, a use-after-free vulnerability can cause memory corruption and permit local privilege escalation if the attacker has System privileges, with no user interaction needed. | Local privilege escalation, memory corruption |
Recommendations:
Here are some recommendations below
- Once OEM updates are available, make sure to update your device promptly to apply the latest security patches addressing these vulnerabilities.
- Avoid connecting to unknown networks to reduce the risk of remote exploitation.
- Keep your device’s operating system and apps updated to the latest version.
Conclusion:
MediaTek’s recent security update addresses critical vulnerabilities, especially in modem firmware, that could allow remote attacks without user interaction. Although no active exploits have been found, the severity and scope of these flaws make it vital for manufacturers and users to promptly apply patches to protect devices and data.
The company reassures end users that proactive notification and remediation precede public disclosure, underscoring MediaTek’s commitment to chipset and product security.
References:
Automotive Security under fire as Firmware Flipper Zero of Dark Web break Rolling Code security of Latest Vehicles
Security researchers discovered Firmware for device related to Flipper Zero and showcased by YouTube channel Talking Sasquatch.
A cyber threat that can bring in significant escalation in automotive cybersecurity that demands a single intercepted signal to compromise a vehicle’s entire key automotive functionality. Rolling code security systems basically protects millions of modern vehicles.
Automative vehicles may use encryption to avoid eavesdropping (i.e., capture and decoding of signals) or tampering attacks (i.e., “flipping” lock signals to unlocks). However, replaying signals, even if they are encrypted, is straightforward.
Rolling code security
That is where rolling code come in action and have been introduced wherein a particular code2 (e.g., an “unlock” code) is considered disposable, i.e., it is only used once. In a nutshell, every button click on the key fob triggers a counter in the key fob and in the vehicle upon reception to roll, making it valid for subsequent use in the future. (https://dl.acm.org/doi/full/10.1145/3627827)
Single capture attack method: For this new attack to work, all that is needed is a single button-press capture from the keyfob, without any jamming. Just from that single capture, it is able to emulate all the keyfob’s functions, including lock, unlock, and unlock trunk. A consequence of this is that the original keyfob gets out of sync, and will no longer function.
According to the Talking Sasquatch, the attack works by simply reverse engineering the rolling code sequence, either through sequence leaks or prior brute forcing of the sequence from a large list of known codes.
Challenges in Automotive landscape
The automotive landscape has transformed into a convergence of software and mechanics, introducing exciting possibilities for vehicle performance and convenience. New concerns on vulnerabilities raises eyes about how malicious actors can exploit codes.
Regardless of the method, videos demonstrating the attack show that only a single capture is needed to emulate a keyfob completely.
Affected vehicles include Chrysler, Dodge, Fiat, Ford, Hyundai, Jeep, Kia, Mitsubishi and Subaru. As of yet, there appears to be no easy fix for this, other than mass vehicle recalls.
Secure coding
It is advised that regular code reviews is published that uses latest static analysis tools help detect vulnerabilities early in the development process.
Keep a secured update mechanisms enable swift responses to emerging threats that can address security vulnerabilites
Let’s understand the importance of of security and feel responsible for it and that requires best practices, cyber security culture and implementing early testing.
What can manufactures do to avoid cyber security lapses
For manufactures its advisable DevSecOps and automotive fuzzing tools that offer great solutions to prevent crashes further they improve efficiency and accuracy of their testing efforts and minimize costs.
GaarudNode from Intruceptlabs
GaarudNode is an all-in-one solution designed to empower development teams with the tools they need to secure their applications throughout the development lifecycle. By combining the power of SAST, DAST, SCA, API security, and CSPM, GaarudNode provides a comprehensive security framework that ensures your applications are built, tested, and deployed with confidence.
Sources: https://www.rtl-sdr.com/flipperzero-darkweb-firmware-bypasses-rolling-code-security/)
Firmware Vulnerabilities affecting Dell Laptops Could allow attackers to achieve persistent access
A set of vulnerabilities affecting millions of Dell laptops used by government agencies, cybersecurity professionals, and enterprises worldwide. The vulnerability known as “ReVault,” mainly target the Broadcom BCM5820X security chip embedded in Dell’s ControlVault3 firmware.
This subsequently create opportunities for attackers to steal passwords, biometric data, and maintain persistent access to compromised systems.
How does the vulnerability work
Most of the flaws reside in the firmware for ControlVault3 and ControlVault3+, which are hardware security components that store passwords, biometric templates, and security codes.
The lists includes:
- Two out-of-bounds vulnerabilities (CVE-2025-24311, CVE-2025-25050)
- An arbitrary free (CVE-2025-25215) flaw
- A stack-overflow bug (CVE-2025-24922)
- An unsafe-deserialization flaw (CVE-2025-24919)
According to the researchers, the vulnerabilities can be exploited in so-called ReVault attacks by:
- Attackers who have achieved non-administrative access/privileges on a vulnerable target laptop. The vulnerabilities may allow them to interact with the ControlVault firmware and leak key material that would allow them to permanently modify the firmware (i.e., effectively creating a potential backdoor into the system)
- Attackers that have physical access to the laptop. They could pry the device open, use a custom connector to access the Unified Security Hub board (which runs ControlVault) over USB, and exploit those vulnerabilities – all without having to log into the system beforehand or having knowledge of the full-disk encryption password.
“Another interesting consequence of this scenario is that if a system is configured to be unlocked with the user’s fingerprint, it is also possible to tamper with the CV firmware to accept any fingerprint,” as per researchers.
Technical details have not been publicly shared, but they have, of course, been privately reported to Dell and Broadcom.
These are 5 critical vulnerabilities of ReVault found by Cisco Talos researcher
ReVault Attack – Five Critical Vulnerabilities
ControlVault3 and ControlVault3+ systems:
- CVE-2025-24311: An out-of-bounds read vulnerability that enables information leakage
- CVE-2025-25050: An out-of-bounds write flaw allowing code execution
- CVE-2025-25215: An arbitrary memory free vulnerability
- CVE-2025-24922: A stack-based buffer overflow enabling arbitrary code execution
- CVE-2025-24919: An unsafe deserialization flaw in ControlVault’s Windows APIs
Importance of device security posture/Endpoint security
The incident highlight how device posture check is designed to evaluate threat that a device poses to an organization and its systems.
The persistent nature of these attacks represents a significant escalation in firmware-based threats, as the malicious code resides below the operating system level.
Here traditional antivirus solutions cannot detect or remove it. Now sophistication of cyber threats means that organizations need to become more proactive in terms of defense.
The identification and mitigation of a threat early on, via an effective and clearly defined security posture, reduces costs, lessens downtime, and minimizes reputational damage.
Periodic security audits are essential to have a complete check on all the security features of the organization. Such audits identify vulnerabilities in the current security controls and allow for ensuring things align properly with industry standards.
Importance of Endpoint security
End point security detect and prevent security threats like file-based malware attacks among other malicious activities. It also provides investigation and remediation capabilities needed to respond to dynamic security incidents and alerts.
Conclusion:
Protecting against endpoint attacks is challenging for organisation because endpoints exist where humans and machines intersect. With the increasing number of adversaries trying to breach organizations using sophisticated cyberattacks, quickly detecting potential threats will help speed the remediation process and keep data protected.
(Source: https://www.helpnetsecurity.com/2025/08/05/dell-laptops-firmware-vulnerabilities-revault-attacks/)
RCE Risk in D-Link Routers due to Hardcoded Telnet Credentials
Summary A significant security flaw (CVE-2025-46176) has exposed thousands of D-Link routers to remote code execution attacks through hardcoded Telnet credentials embedded in firmware. This is affecting its DIR-605L and DIR-816L routers.
If successful exploitation happens this will enables attackers to modify router configurations, deploy malware, or pivot into internal networks.
| OEM | D-link |
| Severity | Medium |
| CVSS Score | 6.5 |
| CVEs | CVE-2025-46176 |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
The flaw exposes devices to remote command execution (RCE) through hardcoded Telnet credentials.
The vulnerability has been rated medium in severity (CVSS 6.5), with no official firmware patch available as of May 2025.
| Vulnerability Name | CVE ID | Product Affected | Severity | Fixed Version |
| Hardcoded Telnet Credentials vulnerability | CVE-2025-46176 | D-Link Router | Medium | No official fix available |
Technical Summary
The vulnerability arises from hardcoded Telnet credentials in the router firmware, which allows unauthenticated remote attackers to execute arbitrary commands.
Firmware analysis revealed embedded credentials in configuration files used during Telnet service initialization.
Security experts recommended retiring these EOL devices due to absence of security support and the impossibility of removing hardcoded credentials through configuration changes.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-46176 | D-Link DIR-605L v2.13B01, DIR-816L v2.06B01 | Telnet service (/usr/sbin/telnetd -l /bin/sh -u Alphanetworks:$image_sign) uses hardcoded credentials from image_sign file, exposing plaintext passwords. | RCE |
Recommendations:
As of May 2025, no firmware updates are available to fix the vulnerability. Recommended temporary mitigations include :
- Disable Telnet access via the router’s web interface.
- Block Telnet port (23) using firewall rules:
“iptables -A INPUT -p tcp –dport 23 -j DROP”
- Restrict WAN access to management interfaces.
- Monitor D-Link’s official support page for firmware updates.
Conclusion:
Security researchers discovered the flaw through firmware analysis, revealing that both router models contain default Telnet credentials that cannot be changed by users.
While exploitation likelihood is currently assessed as low, vulnerability enables unauthenticated attackers to gain control of the routers, affecting confidentiality, integrity and availability.
Immediate mitigation is advised, especially for publicly exposed devices and Security experts strongly recommend retiring these EOL devices due to the absence of security support and the impossibility of removing hardcoded credentials through configuration changes.
Threat from Legacy Devices:
The vulnerability in Telnet revealed security risks that legacy networking equipment carry with them and is embedded hardcoded credentials in IoT devices.
Inadequate security, harboring multiple unpatched vulnerabilities and relying on inadequate security controls that fail to address underlying risks. This poses a threat not only to device itself, but also to the network and connected critical assets.
References:
Tesla Model 3 VCSEC Vulnerability Allows Remote Code Execution via TPMS Exploit
Summary of Security Advisory
A high-severity vulnerability (CVE-2025-2082) in Tesla Model 3’s Vehicle Controller Security (VCSEC) module allows attackers within wireless range to remotely execute arbitrary code by exploiting a flaw in the Tire Pressure Monitoring System (TPMS)
| OEM | Tesla |
| Severity | High |
| CVSS Score | 7.5 |
| CVEs | CVE-2025-2082 |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
This provides potentiality in giving access to critical vehicle controls; Tesla has addressed the issue in firmware version 2024.14.
| Vulnerability Name | CVE ID | Product Affected | Severity | CVSS Score |
| Remote Code Execution vulnerability | CVE-2025-2082 | Tesla Model 3 | High | 7.5 |
Technical Summary
The vulnerability lies in the VCSEC module, responsible for security functions like immobilization, door locking, and TPMS monitoring.
An integer overflow occurs when the VCSEC processes malformed certificate responses transmitted via the TPMS subsystem. Exploiting this flaw enables memory corruption, leading to remote code execution.
The attack does not require user interaction or authentication and can be carried out over adjacent wireless interfaces such as Bluetooth Low Energy (BLE) or Ultra-Wideband (UWB).
Once compromised, attackers may issue unauthorized commands to the Controller Area Network (CAN) bus, which governs safety-critical systems including braking, steering, and acceleration.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-2082 | Tesla Model 3 (pre-2024.14) | Integer overflow in VCSEC module’s certificate handling logic triggered by malformed TPMS messages. | Remote code execution, unauthorized CAN bus access, potential control over critical systems |
Remediation:
- Update Tesla Firmware: Owners should update firmware version 2024.14 via the vehicle’s touchscreen or over-the-air (OTA) updates.
- Avoid Wireless Threats: Refrain from connecting to unknown BLE/UWB networks and using unauthorized TPMS accessories.
Conclusion:
This vulnerability demonstrates how auxiliary vehicle systems like TPMS can serve as entry points for serious security breaches. While Tesla’s prompt patch release, reflects good incident response, this case underscores the urgency for ongoing scrutiny of wireless automotive components. Owners must apply the firmware update and maintain secure update practices to reduce the risk of exploitation.
References:
Microsoft Updates Patch Tuesday for Feb 2025; Address 67 Vulnerabilities, Includes 2 Exploited Zero-Days
Summary
Microsoft’s February 2025 Patch Tuesday addresses multiple security vulnerabilities, including four zero-days, with two actively exploited in the wild. This update covers a total of 67 security flaws, with three classified as critical Remote Code Execution (RCE) vulnerabilities.
Microsoft issued a revision for an older zero-day that threatens the latest Windows desktop and server versions.
| OEM | Microsoft |
| Severity | Critical |
| Date of Announcement | 2025-02-11 |
| No. of Vulnerabilities Patched | 67 |
| Actively Exploited | Yes |
| Exploited in Wild | Yes |
| Advisory Version | 1.0 |
Overview
The affected products include Windows, Microsoft Office, Microsoft Surface, and various network services. Organizations are strongly advised to apply these patches immediately to mitigate security risks and potential cyberattacks.
- 63 Microsoft CVEs addressed
- 4 non-Microsoft CVEs included
The highlighted vulnerabilities include 4 zero-day flaws, 2 of which are currently being actively exploited.
| Vulnerability Name | CVE ID | Product Affected | Severity | CVSS Score |
| Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | CVE-2025-21418 | Windows | High | 7.8 |
| Windows Storage Elevation of Privilege Vulnerability | CVE-2025-21391 | Windows | High | 7.1 |
| Microsoft Surface Security Feature Bypass Vulnerability | CVE-2025-21194 | Windows | High | 7.1 |
| NTLM Hash Disclosure Spoofing Vulnerability | CVE-2025-21377 | Windows | Medium | 6.5 |
Technical Summary
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-21418 | Windows server and Windows 10 & 11 | Windows ancillary function driver for winsock elevation of privilege vulnerability enables attackers to escalate privileges to SYSTEM level. Specific exploitation details are not disclosed. | Unauthorized access with SYSTEM privileges. |
| CVE-2025-21391 | Windows server and Windows 10 & 11 | Windows storage elevation of privilege vulnerability allows attackers to delete targeted files on a system, potentially leading to service unavailability. Does not expose confidential data. | Deletion of critical data, leading to service disruption. |
| CVE-2025-21194 | Microsoft Surface | Microsoft surface security feature bypass vulnerability allows attackers to bypass UEFI protections, compromising the secure kernel. Likely related to “PixieFail” vulnerabilities affecting the IPv6 network stack in Tianocore’s EDK II firmware. | Bypass of security features, potentially compromising system integrity. |
| CVE-2025-21377 | Windows server and Windows 10 & 11 | NTLM hash disclosure spoofing vulnerability exposes NTLM hashes when a user interacts with a malicious file. Simply selecting or right-clicking a file could trigger a remote connection, allowing an attacker to capture NTLM hashes for cracking or pass-the-hash attacks. | Potential for attackers to authenticate as the user, leading to unauthorized access. |
Source: Microsoft
In addition to the actively exploited vulnerabilities, several other critical flaws were also addressed:
- CVE-2025-21376: A Windows Lightweight Directory Access Protocol (LDAP) RCE vulnerability that could allow attackers to execute arbitrary code remotely.
- CVE-2025-21379: A DHCP Client Service RCE vulnerability that may enable remote attackers to execute code with elevated privileges.
- CVE-2025-21381: An RCE vulnerability in Microsoft Excel that could be triggered through malicious spreadsheet files.
Remediation:
- Apply Updates: Immediately install the February 2025 Patch Tuesday updates to address these vulnerabilities.
Conclusion:
The February 2025 Patch Tuesday release addresses critical security vulnerabilities, including actively exploited zero-days. Timely application of these updates is essential to protect systems from potential threats. Organizations should review the affected products and implement the necessary patches and mitigations to maintain security integrity.
The attack vector is local, meaning the attacker needs local access — physically or remotely, using SSH method without user interaction and if successful in exploiting, can give the attacker system privileges.
References:
LogoFAIL Exploited to Deploy Bootkitty, the first UEFI bootkit for Linux
Researchers have uncovered the first UEFI bootkit designed specifically for Linux systems, named Bootkitty.
Continue Reading