CVE-2025-59201CWE-284

Network Connection Status Indicator (NCSI) Elevation of Privilege Vulnerability

High · published October 14, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

⚡ A privilege escalation nightmare lurks in the Network Connection Status Indicator (NCSI), waiting for an authorized attacker to take control! 🔥 Think of this as a party where the bouncer lets in anyone with a badge, but some guests sneak in a fake one that grants them access to the VIP lounge — totally unauthorized but appearing legitimate! Imagine an authorized user, once inside, gaining access to sensitive functions they shouldn't see. This could lead to unauthorized data manipulation or system control, putting your entire network at risk. It's a recipe for chaos!

Put simply

Think of this as a party where the bouncer lets in anyone with a badge, but some guests sneak in a fake one that grants them access to the VIP lounge — totally unauthorized but appearing legitimate! This vulnerability arises from improper access control, allowing an authorized attacker to elevate their privileges locally through the NCSI. Essentially, they can access parts of the system they shouldn’t be able to reach just by exploiting a flaw in permissions.

What to do

Imagine an authorized user, once inside, gaining access to sensitive functions they shouldn't see. This could lead to unauthorized data manipulation or system control, putting your entire network at risk. It's a recipe for chaos! To close this gap, promptly patch your systems to the latest version released by the vendor. Review your access control policies and restrict permissions to the bare minimum necessary for users. Regular audits will help catch any lurking misconfigurations! You've got this! With these steps, you’ll be back in superhero mode, protecting your network in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-10-14T17:00Z
EPSS history
Timeline
  • 14 OCT 17:00Z
    Network Connection Status Indicator (NCSI) Elevation of Privilege Vulnerability
    cvelistv5