CVE-2025-21389
Published: 14 January 2025
Summary
CVE-2025-21389 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 14.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly protects against or limits effects of denial-of-service events like the uncontrolled resource consumption in Windows UPnP Device Host.
Protects availability of system resources from exhaustion attacks exploiting the UPnP vulnerability via controlled allocation mechanisms.
Requires timely flaw remediation through patching the specific uncontrolled resource consumption vulnerability in Windows UPnP Device Host as advised by Microsoft.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an uncontrolled resource consumption (CWE-400) vulnerability in Windows UPnP Device Host enabling remote DoS via excessive resource usage with no auth or interaction required, directly mapping to T1499.004 Endpoint Denial of Service (Application or System Exploitation).
NVD Description
Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service over a network.
Deeper analysisAI
CVE-2025-21389, published on 2025-01-14, is an uncontrolled resource consumption vulnerability in the Windows Universal Plug and Play (UPnP) Device Host. This flaw, associated with CWE-400, enables denial of service and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high-impact availability disruption with no confidentiality or integrity effects.
An unauthorized attacker can exploit this vulnerability remotely over a network with low complexity, requiring no privileges or user interaction. Successful exploitation leads to denial of service through excessive resource consumption on the targeted Windows system hosting the UPnP Device Host.
Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21389 provides guidance on patches and mitigation steps.
Details
- CWE(s)