CVE-2025-21210
Microsoft Windows 10 1507 ≤ 10.0.10240.20890
Raw vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-21210 is a medium-severity Failing Open (CWE-636) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 4.2 (Medium).
Operationally, ranked in the top 36% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CP-12 (Safe Mode) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2279
Vulnerability Data
Windows BitLocker Information Disclosure Vulnerability
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.2.1V7.4.1V8.3.3V10.3.4
Mitigating Controls (NIST 800-53 r5) AI
SC-24 directly requires the system to fail to a known state that preserves security properties, structurally stopping fallback to a less-secure mode.
SI-17 mandates explicit fail-safe procedures that activate on indicated failures, preventing the insecure fallback behavior.
CP-12 forces entry into a safe mode on detected conditions, limiting exposure but not covering every failure path.
SA-8 requires application of engineering principles that include fail-secure design, reducing the likelihood the weakness is introduced.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices explicitly include designing error and failure handling to remain in a secure state.
Least-privilege policy and enforcement directly counters the permissive-access fallback example in the CWE.
Hardened baselines and configuration management reduce the chance that error paths default to insecure settings.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The control forces an explicit evaluation step before any response, reducing the chance that a failure condition will default to an unsafe open state.