CVE-2025-21194

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21194
Microsoft Surface Security Feature Bypass Vulnerability

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21194 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:microsoft:surface_hub_2s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_2s:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:microsoft:surface_pro_8_for_business_1983_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_8_for_business_1983:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_go_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_go:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_go_2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_go_2:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:microsoft:surface_hub_3_50_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_3_50:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:microsoft:surface_hub_2s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_2s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:microsoft:surface_pro_7\+_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_7\+:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_go_3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_go_3:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:microsoft:surface_go_3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_3:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_go_2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_go_2:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:microsoft:surface_pro_9_with_5g_1997_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_9_with_5g_1997:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:microsoft:surface_pro_9_with_5g_1996_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_9_with_5g_1996:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_3_1867_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_3_1867:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_3_1872_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_3_1872:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_4_1958_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_4_1958:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_4_1950_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_4_1950:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_4_1952_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_4_1952:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:microsoft:surface_laptop_4_1978_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_4_1978:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:microsoft:windows_dev_kit_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:windows_dev_kit:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:microsoft:surface_hub_2s_85_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_2s_85:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:microsoft:surface_hub_3_50_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_3_50:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:microsoft:surface_hub_3_85_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_3_85:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:microsoft:surface_pro_8_1983_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_8_1983:-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:microsoft:surface_pro_8_for_business_with_lte_advanced_1982_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_8_for_business_with_lte_advanced_1982:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
cpe:2.3:o:microsoft:surface_hub_3_85_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_3_85:-:*:*:*:*:*:*:*

Configuration 26 (hide)

AND
cpe:2.3:o:microsoft:surface_hub_2s_85_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_2s_85:-:*:*:*:*:*:*:*

Configuration 27 (hide)

AND
cpe:2.3:o:microsoft:surface_go_3_1926_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_3_1926:-:*:*:*:*:*:*:*

Configuration 28 (hide)

AND
cpe:2.3:o:microsoft:surface_go_3_1901_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_3_1901:-:*:*:*:*:*:*:*

Configuration 29 (hide)

AND
cpe:2.3:o:microsoft:surface_go_3_2022_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_3_2022:-:*:*:*:*:*:*:*

Configuration 30 (hide)

AND
cpe:2.3:o:microsoft:surface_go_2_1926_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_2_1926:-:*:*:*:*:*:*:*

Configuration 31 (hide)

AND
cpe:2.3:o:microsoft:surface_go_2_1901_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_2_1901:-:*:*:*:*:*:*:*

Configuration 32 (hide)

AND
cpe:2.3:o:microsoft:surface_go_2_1927_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_2_1927:-:*:*:*:*:*:*:*
History

08 Jul 2025, 14:14

Type Values Removed Values Added
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21194 - () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21194 - Vendor Advisory
CWE NVD-CWE-noinfo
First Time Microsoft surface Laptop 3 1867 Firmware
Microsoft surface Pro 9 With 5g 1997
Microsoft surface Pro 9 With 5g 1996
Microsoft surface Go 2 1927
Microsoft surface Laptop 4 1958
Microsoft surface Go 3 1901
Microsoft surface Laptop 4 1950
Microsoft surface Pro 7\+ Firmware
Microsoft surface Go 3 Firmware
Microsoft surface Laptop 3 1872
Microsoft surface Laptop 4 1952
Microsoft surface Laptop Go 2 Firmware
Microsoft surface Laptop 3 1872 Firmware
Microsoft surface Hub 3 85 Firmware
Microsoft surface Go 3 1901 Firmware
Microsoft surface Pro 8 1983 Firmware
Microsoft surface Pro 8 1983
Microsoft surface Hub 3 50 Firmware
Microsoft surface Go 2 1901 Firmware
Microsoft surface Laptop 4 1950 Firmware
Microsoft surface Laptop Go 3 Firmware
Microsoft surface Laptop Go Firmware
Microsoft surface Laptop 4 1978
Microsoft surface Pro 9 With 5g 1997 Firmware
Microsoft surface Pro 8 For Business 1983 Firmware
Microsoft surface Pro 8 For Business With Lte Advanced 1982 Firmware
Microsoft surface Laptop 4 1958 Firmware
Microsoft surface Hub 2s 85 Firmware
Microsoft surface Laptop 3 1867
Microsoft surface Pro 9 With 5g 1996 Firmware
Microsoft surface Pro 8 For Business 1983
Microsoft surface Hub 2s
Microsoft surface Go 3 1926 Firmware
Microsoft windows Dev Kit
Microsoft surface Go 2 1926
Microsoft surface Pro 7\+
Microsoft surface Pro 8 For Business With Lte Advanced 1982
Microsoft surface Laptop 4 1978 Firmware
Microsoft windows Dev Kit Firmware
Microsoft
Microsoft surface Laptop 4 1952 Firmware
Microsoft surface Go 3
Microsoft surface Go 2 1926 Firmware
Microsoft surface Go 2 1927 Firmware
Microsoft surface Go 3 2022
Microsoft surface Hub 2s 85
Microsoft surface Hub 2s Firmware
Microsoft surface Go 2 1901
Microsoft surface Hub 3 50
Microsoft surface Go 3 2022 Firmware
Microsoft surface Laptop Go 2
Microsoft surface Go 3 1926
Microsoft surface Laptop Go 3
Microsoft surface Hub 3 85
Microsoft surface Laptop Go
Summary
  • (es) Vulnerabilidad de omisión de funciones de seguridad de Microsoft Surface
CPE cpe:2.3:o:microsoft:surface_pro_8_for_business_with_lte_advanced_1982_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_9_with_5g_1997:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_laptop_4_1958_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_3_50:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_go:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_go_3_2022_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_go_3:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_laptop_3_1867_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_3_1901:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_go_2_1926_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_3_1872:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_hub_3_85_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:windows_dev_kit:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_7\+:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_3_2022:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_laptop_4_1952_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_hub_2s_85_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_2s_85:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_laptop_3_1872_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_4_1958:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_2_1926:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_hub_3_50_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_4_1978:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_laptop_go_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_8_for_business_1983:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_pro_7\+_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_laptop_4_1978_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_go_2_1927_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_pro_9_with_5g_1997_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_3_85:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_hub_2s:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_2_1927:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_8_1983:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_laptop_go_2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_8_for_business_with_lte_advanced_1982:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_4_1950:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_pro_8_1983_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_3:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_3_1867:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_3_1926:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_laptop_go_3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_4_1952:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_dev_kit_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_pro_8_for_business_1983_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_hub_2s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_go_3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_laptop_4_1950_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_pro_9_with_5g_1996:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_go_3_1926_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_pro_9_with_5g_1996_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_go_3_1901_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_laptop_go_2:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:surface_go_2_1901_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:microsoft:surface_go_2_1901:-:*:*:*:*:*:*:*

11 Feb 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-11 18:15

Updated : 2025-07-08 14:14

NVD link : CVE-2025-21194

Mitre link : CVE-2025-21194

CVE.ORG link : CVE-2025-21194

JSON object : View

Products Affected

microsoft

  • surface_go_2_1926_firmware
  • surface_pro_7\+
  • surface_laptop_4_1950_firmware
  • surface_laptop_go_3_firmware
  • surface_laptop_3_1872_firmware
  • surface_laptop_3_1867_firmware
  • surface_go_2_1901_firmware
  • surface_laptop_4_1958_firmware
  • surface_go_3_firmware
  • surface_go_3_1901_firmware
  • surface_pro_8_for_business_1983
  • surface_go_2_1926
  • surface_laptop_go_2
  • surface_go_3_2022_firmware
  • surface_pro_9_with_5g_1997_firmware
  • surface_laptop_go_3
  • surface_go_2_1927_firmware
  • windows_dev_kit_firmware
  • surface_pro_8_for_business_1983_firmware
  • surface_laptop_go_2_firmware
  • surface_laptop_4_1952
  • surface_hub_2s_85_firmware
  • surface_go_2_1901
  • surface_hub_3_85_firmware
  • surface_go_3_1926
  • surface_pro_9_with_5g_1996
  • surface_go_2_1927
  • surface_pro_9_with_5g_1997
  • surface_hub_2s_firmware
  • surface_laptop_4_1978
  • surface_laptop_go_firmware
  • surface_pro_8_for_business_with_lte_advanced_1982
  • surface_laptop_4_1952_firmware
  • surface_laptop_4_1978_firmware
  • surface_hub_3_50
  • surface_go_3_1901
  • surface_laptop_3_1867
  • surface_hub_3_85
  • surface_pro_8_for_business_with_lte_advanced_1982_firmware
  • surface_laptop_3_1872
  • surface_laptop_4_1958
  • surface_laptop_go
  • surface_pro_8_1983_firmware
  • surface_laptop_4_1950
  • windows_dev_kit
  • surface_pro_9_with_5g_1996_firmware
  • surface_go_3_2022
  • surface_go_3_1926_firmware
  • surface_pro_7\+_firmware
  • surface_hub_2s_85
  • surface_hub_2s
  • surface_pro_8_1983
  • surface_go_3
  • surface_hub_3_50_firmware
CWE
CWE-20

Improper Input Validation

NVD-CWE-noinfo