Improper access control in Microsoft Windows Recovery Environment Agent

1) Improper access control

EUVDB-ID: #VU102756

Risk: Low

CVSSv4.0: 3.7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21202

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in Windows Recovery Environment Agent. An attacker with physical access can bypass implemented security restrictions and gain elevated privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 10 21H2 10.0.19041.3920 - 11 24H2 10.0.26100.2894

Windows Server: 2016 10.0.14393.10 - 2025 10.0.26100.2605

CPE2.3

• cpe:2.3:o:microsoft:windows:10:21H2_10.0.19041.3920:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows:10_21H2:10.0.19043.4529:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows:10_21H2:10.0.19044.1147:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows:10_21H2:10.0.19044.1149:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows:10_21H2:10.0.19044.1151:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows:10_21H2:10.0.19044.1165:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows:10_21H2:10.0.19044.1200:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows:10_21H2:10.0.19044.1263:*:*:*:*:*:*
• cpe:2.3:o:microsoft:windows_server:2016:10.0.14393.10:*:*:*:*:*:*

External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-21202

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.