CVE-2025-24076: Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 7.3)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2025-Mar
Released
2025-03-11
EPSS Score
1.60% (percentile: 81.7%)

Description

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

FAQ

How could an attacker exploit this vulnerability? To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then trigger an event that could exploit the vulnerability and save an invalid state to a database or trigger other unintended actions. According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability? Exploitation of the vulnerability requires an attack vector involving both attacker authentication (to modify the DLL) and user interaction (to initiate the Link-to-Phone feature installation and enable the 'Use as a connected camera' option). What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Detection & Weaponization (1 sources)

Maturity: Exploit

  • GitHub PoC: 1 repositories

Affected Products (9)

ESU

  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems

Windows

  • Windows Server 2025 (Server Core installation)
  • Windows 11 Version 23H2 for ARM64-based Systems
  • Windows 11 Version 23H2 for x64-based Systems
  • Windows Server 2022, 23H2 Edition (Server Core installation)
  • Windows 11 Version 24H2 for ARM64-based Systems
  • Windows 11 Version 24H2 for x64-based Systems
  • Windows Server 2025

Security Updates (3)

Acknowledgments

John Ostrowski with <a href="https://www.compass-security.com/en">Compass Security</a>

Revision History

  • 2025-03-11: Information published.