CVE-2025-14252CWE-269privilege-escalation

CVE-2025-14252

High · published December 16, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

⚡ A single misstep in Advantech's SUSI driver can unleash chaos, allowing attackers to read/write memory like a mischievous kid with a crayon! Think of this vulnerability like a restaurant with an unlocked kitchen door. Anyone can waltz in, rearranging ingredients, writing their own recipes, or even changing the menu without anyone noticing! This vulnerability lets attackers escalate privileges, execute arbitrary code, and disclose sensitive information—imagine someone sneaking into a chef's private recipe book! The consequences could be catastrophic, putting your entire system at risk.

Put simply

Think of this vulnerability like a restaurant with an unlocked kitchen door. Anyone can waltz in, rearranging ingredients, writing their own recipes, or even changing the menu without anyone noticing! The Improper Access Control issue in Advantech's SUSI driver (susi.sys) allows unauthorized access to arbitrary memory, I/O ports, and MSRs, enabling attackers to run malicious code and gain elevated privileges.

What to do

This vulnerability lets attackers escalate privileges, execute arbitrary code, and disclose sensitive information—imagine someone sneaking into a chef's private recipe book! The consequences could be catastrophic, putting your entire system at risk. To secure your systems, update to Advantech SUSI version 5.0.24336 or later as soon as possible. Conduct a thorough security audit to ensure no unauthorized access is lingering around. It's crucial to review your access control policies, too! You've got this! By following these steps, you're one step closer to becoming a security hero! 🦸

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00129 · 2.3th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-12-16T11:15Z
References (1)
EPSS history
Timeline
  • 16 DEC 05:19Z
    An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in…
    cvelistv5