Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?
This attack requires a victim to perform a specific action, such as copying files or executing a command, and for an attacker with appropriate access to have pre-planted malicious files with knowledge of where they should be placed on the victim's system.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
This attack requires a victim to perform a specific action, such as copying files or executing a command, and for an attacker with appropriate access to have pre-planted malicious files with knowledge of where they should be placed on the victim's system.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of this vulnerability requires that a user trigger the payload in the application.
Security updates
7.5.0 — https://github.com/PowerShell/Announcements/issues/72
9.0.1 — https://support.microsoft.com/help/5050526
17.12.4 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
Vulnerabilities 1
-
High 7.5
.NET Remote Code Execution Vulnerability
.NET Remote Code Execution Vulnerability
Revision history
-
#2
Revised the Security Updates table to include PowerShell 7.5 installed on Windows, PowerShell 7.5 installed on Linux, and PowerShell 7.5 installed on MacOC because these versions of PowerShell 7 are affected by this vulnerability. See [https://github.com/PowerShell/Announcements/issues/72](https://github.com/PowerShell/Announcements/issues/72) for more information.
-
#1
Information published.
References
-
CVE-2025-21171 .NET Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21171
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss