CVE-2025-55333
Microsoft Windows 10 1507 ≤ 10.0.10240.21161
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2025-55333 is a medium-severity Incomplete Comparison with Missing Factors (CWE-1023) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-34422
Vulnerability Data
Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.3.4V6.3.5V6.1.3V6.5.7
Mitigating Controls (NIST 800-53 r5) AI
Mandating that access-control decisions apply the full set of required rules to each request structurally eliminates missing-factor comparisons.
Access enforcement requires that every authorization decision evaluate all relevant entity attributes, directly stopping incomplete comparisons from being used.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (reviews, testing, static analysis) directly prevent incomplete comparison flaws from being introduced.
Authentication decisions often rely on multi-factor comparisons; incomplete comparisons directly weaken this control.
Enforcing access policy requires complete evaluation of all relevant attributes; missing factors undermine authorization decisions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing comparison factors, yet testing is only one part of the control's scope.
Application security requirements can mandate complete multi-factor comparisons, but the control is broader than this single weakness.
Secure architecture principles can require exhaustive entity comparisons, yet the control addresses many other design concerns.
Secure coding standards can forbid incomplete comparisons, but the control covers a wide range of coding issues.