#VU25251 Security Features in Microsoft Surface Hub - CVE-2020-0702

Vulnerability identifier: #VU25251

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2020-0702

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
Microsoft Surface Hub

Software vendor:
Microsoft

This vulnerability allows a local attacker to bypass security rescritions feature.

The vulnerability exists in Surface Hub when prompting for credentials. An attacker with physical access can access settings which are restricted to Administrators.

Install updates from vendor's website.

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0702