Use of hard-coded credentials in Microsoft products - CVE-2025-27488

Vulnerability identifier: #VU109250

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-27488

CWE-ID: CWE-798

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to presence of hard-coded credentials in application code. A local user can execute arbitrary code with elevated privileges.

Hardware Lab Kit (HLK) for Windows Version 1809
Hardware Lab Kit (HLK) for Windows Server 2019
Hardware Lab Kit (HLK) for Windows 10
Hardware Lab Kit (HLK) for Windows Server 2022
Hardware Lab Kit (HLK) for Windows 11
Hardware Lab Kit (HLK) for Windows Server 2025

Install updates from vendor's website.

Hardware Lab Kit (HLK) for Windows Version 1809 - update to 10.1.17763.7010
Hardware Lab Kit (HLK) for Windows Server 2019 - update to 10.1.17763.7010
Hardware Lab Kit (HLK) for Windows 10 - update to 10.1.19041.5609
Hardware Lab Kit (HLK) for Windows Server 2022 - update to 10.1.20348.3330
Hardware Lab Kit (HLK) for Windows 11 - addressed in versions 10.1.22621.5040, 10.1.26100.3478
Hardware Lab Kit (HLK) for Windows Server 2025 - update to 10.1.26100.3478

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27488

• Privilege escalation in Microsoft Windows Hardware Lab Kit