Summary
ngCERT has detected about 78 (medium to low) vulnerabilities primarily impacting Microsoft Windows components like Windows Digital Media and Secure Boot, as well as Dell firmware. These weaknesses include elevation of privilege (EoP), security feature bypasses, and improper access controls, with CVSS v3.1 scores from 4.3 to 8.1 (low to high severity). Most of these require local access, but exploitation could lead to system compromise or data exposure. Although the vulnerabilities have been patched, there is the urgent need for these systems to be updated and the patches applied, in order to safeguard against exploits and possible cyberattacks.
Description & Consequence
The vulnerabilities mainly affect Microsoft Windows 10/11 and Server 2019/2022, with some impacting Dell firmware and older non-Microsoft products. Key details include:
- Windows Digital Media (EoP): Over 40 CVEs such as (CVE-2025-21229 and CVE-2025-21255) involve improper input validation or out-of-bounds reads, allowing local attackers to gain SYSTEM-level privileges.
- Windows Secure Boot: CVE-2025-21211 allows bypassing Secure Boot via flaws in DBX update validation, enabling unsigned bootloader execution.
- Dell Firmware: CVE-2024-52537 permits high-privileged attackers to exploit symlink issues in Dell Client Platform Firmware Update Utility for privilege escalation.
- Other Microsoft Issues: CVEs like CVE-2024-55541 (audio driver buffer overflow) and CVE-2024-51456 (SMB Remote Code Execution) cover Denial-of-Service (DoS), kernel exploits, and remote code execution.
- Legacy/Other Vendors: Older CVEs such as CVE-2023-50946 in OpenSSH, CVE-2021-29669 in Zyxel) involve RCE, EoP, or information disclosure in non-Microsoft products.
Successful exploitation of these flaws could result to:
- Privilege Escalation: Local attackers could gain SYSTEM access, enabling malware persistence, data theft, or network lateral movement.
- System Integrity Loss: Secure Boot bypass (CVE-2025-21211) allows rootkits or tampered firmware to evade boot protections.
- Service Disruption: Denial of Service (DoS) issues such as (CVE-2024-55541) may crash services or leak kernel memory.
- Chained Attacks: These flaws could enable ransomware or APTs. No active exploits are reported as of October 2025, but local access increases insider threat risks.
Solution
To mitigate these vulnerabilities, ngCERT recommends the following measures:
- Apply Patches: Install Microsoft January 2025 updates via Windows Update or WSUS. For CVE-2024-52537, update Dell firmware using Dell Command Update.
- Enhance Access Controls: Enforce least privilege, disable untrusted media playback, and use AppLocker/WDAC to block unsigned binaries.
- Monitor and Harden: Enable Secure Boot and TPM 2.0; use EDR tools to detect privilege escalation. Apply upstream patches for legacy CVEs such as OpenSSH.
- Verify Systems: Scan for vulnerable versions with tools like Qualys or Tenable. Check Microsoft Security Response Center for updates.
- Best Practices: Segment networks, adopt zero-trust, and test patches in staging environments. Isolate or retire end-of-support systems.
Reference
Revision
