CVE-2025-62570CWE-284broken-access-control

CVE-2025-62570

High · published December 9, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

⚡ A sneaky access control slip in the Windows Camera Frame Server Monitor could let authorized users peek at sensitive info locally! 🔍 Think of it like a hotel room where the staff can enter without proper checks. They might have a key, but they shouldn't be allowed to snoop around in your personal belongings without permission! This oversight allows someone with legitimate access to potentially expose private information, creating a risk of data leaks or unauthorized data manipulation. If left unaddressed, it could lead to privacy breaches that are absolutely devastating for users.

Put simply

Think of it like a hotel room where the staff can enter without proper checks. They might have a key, but they shouldn't be allowed to snoop around in your personal belongings without permission! The vulnerability stems from improper access control in the Windows Camera Frame Server Monitor, which fails to adequately restrict data access for authorized users, allowing them to disclose sensitive information locally.

What to do

This oversight allows someone with legitimate access to potentially expose private information, creating a risk of data leaks or unauthorized data manipulation. If left unaddressed, it could lead to privacy breaches that are absolutely devastating for users. Update to the latest version of Windows to patch this vulnerability immediately. Review access controls and ensure only necessary personnel have access to sensitive data. Regularly audit permissions across your systems to minimize potential exposure. You've got this! Follow these steps and secure your system like a pro! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00404 · 33.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-12-09T23:16Z
Affected products (3)
ProductVersionsFixed in
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:56Z
    Windows Camera Frame Server Monitor Information Disclosure Vulnerability
    cvelistv5