CVE-2025-21198
Published: 11 February 2025
Summary
CVE-2025-21198 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Microsoft Hpc Pack 2016. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 37.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific RCE vulnerability in Microsoft HPC Pack by identifying, reporting, and applying vendor patches from the MSRC advisory.
Addresses CWE-306 missing authentication for critical function by restricting and documenting permitted actions without identification or authentication in HPC Pack.
Enforces approved authorizations for access to critical functions, preventing low-privileged adjacent network attackers from achieving RCE.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication enables remote exploitation of the HPC service for code execution (T1210) with scope-changing privilege escalation (T1068).
NVD Description
Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21198 is a remote code execution vulnerability affecting Microsoft High Performance Compute (HPC) Pack. Published on 2025-02-11, it carries a CVSS v3.1 base score of 9.0, reflecting its critical severity with vector AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The issue is linked to CWE-306 (Missing Authentication for Critical Function) and lacks additional CWE details from NVD.
Exploitation requires an attacker to have low privileges (PR:L) on an adjacent network (AV:A) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows scope change (S:C), granting high-impact remote code execution with full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H).
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21198 provides details on patches and mitigation guidance.
Details
- CWE(s)