CVE-2025-21194

HIGH

Microsoft Surface Firmware - Security Feature Bypass via Improper Input Validation

Title source: llm

Microsoft Surface Security Feature Bypass Vulnerability

Core 1

Core References

Vendor Advisory vendor-advisory patch

CVSS v3 7.1

EPSS 0.0019

EPSS Percentile 40.9%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

CWE

CWE-20

Status published

Products (27)

microsoft/surface_go_2_1901_firmware

microsoft/surface_go_2_1926_firmware

microsoft/surface_go_2_1927_firmware

microsoft/surface_go_3_1901_firmware

microsoft/surface_go_3_1926_firmware

microsoft/surface_go_3_2022_firmware

microsoft/surface_go_3_firmware

microsoft/surface_hub_2s_85_firmware

microsoft/surface_hub_2s_firmware

microsoft/surface_hub_3_50_firmware

... and 17 more

Published Feb 11, 2025

Tracked Since Feb 18, 2026