CVE-2025-27488

Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27488	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_10_1809:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

Configuration 2 (hide)

AND

cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_10_2004:-:::::::*
	cpe:2.3:o:microsoft:windows_10_20h2:-:::::::*
	cpe:2.3:o:microsoft:windows_10_21h1:-:::::::*
	cpe:2.3:o:microsoft:windows_10_21h2:-:::::::*
	cpe:2.3:o:microsoft:windows_10_22h2:-:::::::*

Configuration 3 (hide)

AND

cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_11_24h2:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2025:-:::::::*

History

19 May 2025, 18:21

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-13 17:15

Updated : 2025-05-19 18:21

NVD link : CVE-2025-27488

Mitre link : CVE-2025-27488

CVE.ORG link : CVE-2025-27488

JSON object : View

Products Affected

microsoft

windows_10_22h2
windows_server_2022
windows_10_20h2
windows_10_2004
windows_10_21h1
windows_server_2025
windows_10_21h2
windows_11_22h2
windows_server_2019
windows_11_24h2
windows_10_1809
windows_hardware_lab_kit

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2025-27488", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secure@microsoft.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2025-05-13T17:15:52.440", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27488", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally."}, {"lang": "es", "value": "El uso de credenciales codificadas en Windows Hardware Lab Kit permite a un atacante autorizado elevar privilegios localmente."}], "lastModified": "2025-05-19T18:21:27.673", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94ADD493-8F94-407D-9800-C600BB618620", "versionEndExcluding": "10.1.17763.7010"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2E332666-2E03-468E-BC30-299816D6E8ED"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "110F984A-45DD-4A65-A367-DFFE41620E90", "versionEndExcluding": "10.1.19041.5609"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D4DBE5B2-AE10-4251-BCDA-DC5EDEE6EE67"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6AFD13A6-A390-4400-9029-2F4058CA17E2"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B1FED4C9-B680-4F44-ADC0-AC43D6B5F184"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2F513002-D8C1-4D3A-9F79-4B52498F67E9"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4D8DC08D-A860-493A-8AA6-1AD4A0A511AD"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFB39DD7-7231-40F1-86C4-3C0E8BBFE466", "versionEndExcluding": "10.1.20348.3330"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E6F0DAC-B3E9-4921-8802-21C09222B176", "versionEndExcluding": "10.1.22621.5040"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D4793BFB-2E4E-4067-87A5-4B8749025CA3"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:windows_hardware_lab_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F534E7C-8068-4D89-9DD8-B1BD9C3F6425", "versionEndExcluding": "10.1.26100.3478"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A529CED5-0DF0-4203-85C0-894CAF37E159"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C2145B2C-E779-4CB3-8D0E-0786DD5A7EE1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "secure@microsoft.com"}