Security Features in Microsoft Surface Hub - CVE-2020-0702

Vulnerability identifier: #VU25251

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-0702

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

This vulnerability allows a local attacker to bypass security rescritions feature.

The vulnerability exists in Surface Hub when prompting for credentials. An attacker with physical access can access settings which are restricted to Administrators.

Microsoft Surface Hub

Install updates from vendor's website.

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0702

• Security feature bypass in Microsoft Surface Hub