CVE-2025-27488HighCVSS 6.7
Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability
🔗 CVE IDs covered (1)
📋 Description
Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally.
🎯 Affected products11
- Windows 10 HLK Version 22H2
- Windows 10 HLK version 20H2
- Windows 10 HLK version 21H1
- Windows 10 HLK version 21H2
- Windows 11 HLK 22H2
- Windows 11 HLK 24H2
- Windows HLK for Windows 10 version 2004
- Windows HLK for Windows Server 2019
- Windows HLK for Windows Server 2022
- Windows HLK for Windows Server 2025
- Windows HLK, version 1809
✅ Remediation
KBRelease Notes (Security Update) — fixed build 10.1.26100.3478 KBRelease Notes (Security Update) — fixed build 10.1.17763.7010 KBRelease Notes (Security Update) — fixed build 10.1.19041.5609 KBRelease Notes (Security Update) — fixed build 10.1.22621.5040 KBRelease Notes (Security Update) — fixed build 10.1.20348.3330
🔗 References (7)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27488
- patchhttps://go.microsoft.com/fwlink/?linkid=2320012
- referencehttps://learn.microsoft.com/en-us/windows-hardware/test/hlk/what-s-new-in-the-hardware-lab-kit#whats-new-in-previous-releases
- patchhttps://go.microsoft.com/fwlink/?linkid=2319329
- patchhttps://go.microsoft.com/fwlink/?linkid=2320002
- patchhttps://go.microsoft.com/fwlink/?linkid=2320114
- patchhttps://go.microsoft.com/fwlink/?linkid=2320003