CVE-2025-21293

Published Jan 14, 2025

Last updated 12 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-21293 is an elevation of privilege vulnerability in Microsoft Active Directory Domain Services. It allows attackers to gain elevated privileges on a system where they already have user-level access. The vulnerability stems from overly permissive access control lists (ACLs) associated with certain registry keys. Specifically, the "Network Configuration Operators" group has the "CreateSubKey" permission on sensitive registry keys. Exploitation of this vulnerability involves manipulating these registry keys, particularly those related to performance counters, to escalate privileges. This vulnerability was discovered by BirkeP while investigating the "Network Configuration Operators" group and its permissions within the registry. The researcher collaborated with Clément Labro, who developed a method to weaponize performance counters for exploitation.

Description: Active Directory Domain Services Elevation of Privilege Vulnerability
Source: secure@microsoft.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-284
nvd@nist.gov: NVD-CWE-noinfo

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 6

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "D5C2C390-24E9-42C9-84BF-EE28670CAB30",
            "versionEndExcluding": "10.0.10240.20890"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "C0B9C790-A26D-4EBD-B5CA-F0C628835A21",
            "versionEndExcluding": "10.0.10240.20890"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "DE0F44E5-40C1-4BE3-BBA4-507564182682",
            "versionEndExcluding": "10.0.14393.7699"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "83F40BB6-BBAE-4CD4-A5FE-1DAF690101AB",
            "versionEndExcluding": "10.0.14393.7699"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "1BB028F9-A802-40C7-97BF-1D169291678F",
            "versionEndExcluding": "10.0.17763.6775"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "9F077951-8177-4FEE-A49A-76E51AE48CE0",
            "versionEndExcluding": "10.0.17763.6775"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5D64D2C7-51C3-47EB-B86E-75172846F4DF",
            "versionEndExcluding": "10.0.19044.5371"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BC92CC57-B18C-43C3-8180-9A2108407433",
            "versionEndExcluding": "10.0.19045.5371"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D84EDF98-16E1-412A-9879-2C2FEF87FB2B",
            "versionEndExcluding": "10.0.22621.4751"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "282E3839-E953-4B14-A860-DBACC1E99AFF",
            "versionEndExcluding": "10.0.22631.4751"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "78A3F671-95DC-442A-A511-1E875DF93546",
            "versionEndExcluding": "10.0.26100.2894"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DA4426DD-B748-4CC4-AC68-88AD963E5F0C",
            "versionEndExcluding": "10.0.14393.7699"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8F604C79-6A12-44C9-B69D-A2E323641079",
            "versionEndExcluding": "10.0.17763.6775"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7B8C9C82-359E-4318-A10D-AA47CDFB38FE",
            "versionEndExcluding": "10.0.20348.3091"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E3E0C061-2DA7-4237-9607-F6792DC92DD3",
            "versionEndExcluding": "10.0.25398.1369"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "2CFD18D5-3C1F-4E3A-A143-EE3F1FFBB880",
            "versionEndExcluding": "10.0.26100.2894"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]