CVE-2025-6250: Privilege Management for Windows - Elevation of Privilege
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6250?
CVE-2025-6250 is considered a high severity vulnerability due to its potential to allow unauthorized administrative access.
How do I fix CVE-2025-6250?
To mitigate CVE-2025-6250, upgrade to version 25.4.270.0 or later of Microsoft wmic.exe and ensure the Defendpoint service is not stopped by unauthorized users.
What systems are impacted by CVE-2025-6250?
CVE-2025-6250 affects Microsoft wmic.exe versions prior to 25.4.270.0 and Microsoft Defendpoint versions up to and including 25.4.270.0.
Can CVE-2025-6250 be exploited remotely?
CVE-2025-6250 requires local access with elevated permissions, meaning it cannot be exploited remotely without previous access.
What are the consequences of a successful exploit of CVE-2025-6250?
If successfully exploited, CVE-2025-6250 allows a malicious user to stop the Defendpoint service, gain administrative rights, and execute processes with elevated permissions.