CVE-2025-21194

—

CVSS 3.1

7.1 high

EPSS

<1%p56

Published

Feb 11, 2025 (Feb 11, 2025)

Modified

Jun 17, 2026

Description

Microsoft Surface Security Feature Bypass Vulnerability

Vendors: microsoft
Products: surface hub 2s firmware, surface pro 8 for business 1983 firmware, surface laptop go firmware, surface laptop go 2 firmware, surface hub 3 50 firmware, surface pro 7\+ firmware, surface laptop go 3 firmware, surface go 3 firmware, surface pro 9 with 5g 1997 firmware, surface pro 9 with 5g 1996 firmware, surface laptop 3 1867 firmware, surface laptop 3 1872 firmware
Weakness: CWE-20
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news3 stories

Microsoft Fixes Another Two Actively Exploited Zero

Infosecurity MagazineFeb 12, 09:45 UTC · Feb 12, 2025Exploit / PoC in the wildCVE-2025-21391 CVE-2025-21418 CVE-2025-21194+1 CVEs

60

Microsoft Patch Tuesday security updates for February 2025 ficed 2 actively exploited bugs

Security AffairsFeb 12, 07:27 UTC · Feb 12, 2025Vulnerability in the wildCVE-2025-21391 CVE-2025-21418 CVE-2025-21194+1 CVEs

60

Microsoft fixes two actively exploited zero-days (CVE-2025-21418, CVE-2025-21391)

Help Net SecurityFeb 11, 00:00 UTC · Feb 11, 2025Exploit / PoC in the wildCVE-2025-21418 CVE-2025-21391 CVE-2024-38193+3 CVEs2

60