Security Features in Microsoft Surface Hub - CVE-2020-0702

Vulnerability identifier: #VU25251

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2020-0702

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Microsoft

Affected software:
Microsoft Surface Hub

This vulnerability allows a local attacker to bypass security rescritions feature.

The vulnerability exists in Surface Hub when prompting for credentials. An attacker with physical access can access settings which are restricted to Administrators.

Install updates from vendor's website.

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0702