CVE-2025-62474CWE-284broken-access-control

CVE-2025-62474

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

⚡ An authorized attacker can elevate their privileges locally in Windows Remote Access Connection Manager! It’s like giving someone a master key to your office without the security personnel noticing! 🔐 Picture a hotel where a guest finds a way to access the staff-only areas, sneaking behind the desk to access all the confidential records. The improper access control here allows them to stroll right into restricted zones, causing chaos! Imagine if that guest could suddenly change room charges, access sensitive information, or even make unauthorized bookings! In a similar fashion, an attacker could exploit this vulnerability to gain elevated privileges on your system, leading to potentially devastating consequences for your data and security.

Put simply

Picture a hotel where a guest finds a way to access the staff-only areas, sneaking behind the desk to access all the confidential records. The improper access control here allows them to stroll right into restricted zones, causing chaos! This vulnerability arises from improper access control in the Windows Remote Access Connection Manager, enabling an authorized user to escalate their privileges locally without proper restrictions in place.

What to do

Imagine if that guest could suddenly change room charges, access sensitive information, or even make unauthorized bookings! In a similar fashion, an attacker could exploit this vulnerability to gain elevated privileges on your system, leading to potentially devastating consequences for your data and security. To address this vulnerability, ensure your systems are updated to the latest security patch provided by Microsoft. Regularly review user permissions to limit unnecessary access rights, and consider implementing additional security measures like monitoring user activities. You've got this! By taking action now, you'll bolster your security and keep your systems safe. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00366 · 29.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-12-09T23:15Z
Affected products (17)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.868810.0.14393.8688
microsoft/windows_10_1607< 10.0.14393.868810.0.14393.8688
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.868810.0.14393.8688
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
microsoft/windows_server_2022_23h2< 10.0.25398.202510.0.25398.2025
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
    cvelistv5