Description
Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows 10 HLK version 20H2 | 1.0.0 – < 10.1.19041.5609 | 10.1.19041.5609 |
| Microsoft | Windows 10 HLK version 21H1 | 1.0.0 – < 10.1.19041.5609 | 10.1.19041.5609 |
| Microsoft | Windows 10 HLK version 21H2 | 1.0.0 – < 10.1.19041.5609 | 10.1.19041.5609 |
| Microsoft | Windows 10 HLK Version 22H2 | 1.0.0 – < 10.1.19041.5609 | 10.1.19041.5609 |
| Microsoft | Windows 11 HLK 22H2 | 1.0.0 – < 10.1.22621.5040 | 10.1.22621.5040 |
| Microsoft | Windows 11 HLK 24H2 | 1.0.0 – < 10.1.26100.3478 | 10.1.26100.3478 |
| Microsoft | Windows HLK for Windows 10 version 2004 | 1.0.0 – < 10.1.19041.5609 | 10.1.19041.5609 |
| Microsoft | Windows HLK for Windows Server 2019 | 1.0.0 – < 10.1.17763.7010 | 10.1.17763.7010 |
| Microsoft | Windows HLK for Windows Server 2022 | 1.0.0 – < 10.1.20348.3330 | 10.1.20348.3330 |
| Microsoft | Windows HLK for Windows Server 2025 | 1.0.0 – < 10.1.26100.3478 | 10.1.26100.3478 |
| Microsoft | Windows HLK, version 1809 | 1.0.0 – < 10.1.17763.7010 | 10.1.17763.7010 |
Advisories 5
- WID-SEC-2025-1050 Microsoft Windows Server: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Mar 15, 2026
- WID-SEC-2025-1014 Microsoft Azure: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 13, 2025
- NCSC-2025-0159 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · May 13, 2025
- NCSC-2025-0156 Kwetsbaarheden verholpen in Microsoft Azure NCSC-NL (Netherlands) · May 13, 2025
- MSRC-CVE-2025-27488 Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability Microsoft Security Response Center · May 13, 2025
References
- Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability vendor-advisory patch