CVE-2025-21389
Published: 14 January 2025
Summary
CVE-2025-21389 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 14.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2025-21389 is an uncontrolled resource consumption vulnerability, tracked under CWE-400, that affects the Windows Universal Plug and Play (UPnP) Device Host component. The flaw received a CVSS 3.1 base score of 7.5 and permits remote triggering without authentication or user interaction, resulting in a high impact to availability while leaving confidentiality and integrity unaffected.
An unauthenticated attacker with network access can send crafted requests to the UPnP Device Host service, causing it to consume excessive resources and produce a denial-of-service condition. Because the attack requires no privileges or user interaction and can be launched over the network, any reachable Windows system exposing the affected component is potentially at risk.
Microsoft has published an advisory for CVE-2025-21389 at the Microsoft Security Response Center update guide, which security practitioners should consult for official patch availability and remediation guidance. The associated EPSS score has remained low, moving only from a peak of 0.0332 to a current value of 0.0241, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2450
Vulnerability details
Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an uncontrolled resource consumption (CWE-400) vulnerability in Windows UPnP Device Host enabling remote DoS via excessive resource usage with no auth or interaction required, directly mapping to T1499.004 Endpoint Denial of Service (Application or System Exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly protects against or limits effects of denial-of-service events like the uncontrolled resource consumption in Windows UPnP Device Host.
Protects availability of system resources from exhaustion attacks exploiting the UPnP vulnerability via controlled allocation mechanisms.
Requires timely flaw remediation through patching the specific uncontrolled resource consumption vulnerability in Windows UPnP Device Host as advised by Microsoft.