CVE-2025-24994
Published: 11 March 2025
Summary
CVE-2025-24994 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Windows 11 22H2. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 48.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and correction of the improper access control flaw in Windows Cross Device Service to prevent local privilege escalation.
Enforces approved authorizations for access to system resources, directly addressing the improper access control vulnerability enabling privilege escalation.
Limits privileges of local low-privilege accounts and services, reducing the potential impact and scope of escalation from CVE-2025-24994 exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper access control vulnerability in Windows service directly enables local privilege escalation by low-privileged attackers.
NVD Description
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2025-24994 is an improper access control vulnerability (CWE-284) in the Windows Cross Device Service, published on 2025-03-11. It carries a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) and affects Windows operating systems where the service is present.
A local attacker with low privileges (PR:L) can exploit this vulnerability through low-complexity techniques (AC:L) that require user interaction (UI:R). Successful exploitation enables privilege escalation, granting high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope.
The Microsoft Security Response Center provides an update guide with details on patches and mitigation at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24994.
Details
- CWE(s)