CVE-2025-21198CWE-306

Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability

Critical · published February 11, 2025

CVSS v3.1
9.0
EPSS
1%
Percentile
60.7
In the wild
Unconfirmed
What it is

🚨 A single misstep in Microsoft HPC Pack can open the floodgates for remote code execution! 🔥 Think of it like a hidden door in a high-security vault — if an attacker finds the key, they can waltz right in and do anything they want inside! 🏰 With this vulnerability, an attacker could execute arbitrary code on the system, potentially leading to full control over the computing environment. This could result in unauthorized data access, modification, or even complete system compromise! Imagine the chaos of a thief rummaging through your most confidential files!

Put simply

Think of it like a hidden door in a high-security vault — if an attacker finds the key, they can waltz right in and do anything they want inside! 🏰 The flaw exists due to improper validation of input parameters, allowing an attacker to send specially crafted requests to the HPC Pack service. This may lead to arbitrary code execution in the context of the service user, which is typically a high-privileged user.

What to do

With this vulnerability, an attacker could execute arbitrary code on the system, potentially leading to full control over the computing environment. This could result in unauthorized data access, modification, or even complete system compromise! Imagine the chaos of a thief rummaging through your most confidential files! Immediately patch your HPC Pack to the latest version to close this critical vulnerability. Additionally, review your security configurations and restrict access to the service to trusted users only to minimize risk. You've got this! With these steps, you'll have your systems fortified in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00942 · 60.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-02-11T17:58Z
EPSS history
Timeline
  • 11 FEB 17:58Z
    Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
    cvelistv5