CVE-2025-21194

nvd nist

Published: Feb 11, 2025Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Microsoft Surface Security Feature Bypass Vulnerability

Affected (27)

Microsoft

27 products

Surface Pro 8 For Business 1983 Firmware

Surface Laptop Go Firmware

Surface Hub 2s Firmware

Surface Pro 7+ Firmware

Surface Laptop Go 3 Firmware

Surface Go 3 Firmware

Surface Laptop Go 2 Firmware

Surface Pro 9 With 5g 1997 Firmware

Surface Pro 9 With 5g 1996 Firmware

Surface Laptop 3 1867 Firmware

Surface Laptop 3 1872 Firmware

Surface Laptop 4 1958 Firmware

Surface Laptop 4 1950 Firmware

Surface Laptop 4 1952 Firmware

Surface Laptop 4 1978 Firmware

Windows Dev Kit Firmware

Surface Hub 3 50 Firmware

Surface Pro 8 1983 Firmware

Surface Pro 8 For Business With Lte Advanced 1982 Firmware

Surface Hub 3 85 Firmware

Surface Hub 2s 85 Firmware

Surface Go 3 1926 Firmware

Surface Go 3 1901 Firmware

Surface Go 3 2022 Firmware

Surface Go 2 1926 Firmware

Surface Go 2 1901 Firmware

Surface Go 2 1927 Firmware

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Pro 8 For Business 1983 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Pro 8 For Business 1983	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Laptop Go Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Laptop Go	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Hub 2s Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Hub 2s	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Pro 7+ Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Pro 7+	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Laptop Go 3 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Laptop Go 3	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Go 3 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Go 3	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Laptop Go 2 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Laptop Go 2	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Pro 9 With 5g 1997 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Pro 9 With 5g 1997	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Pro 9 With 5g 1996 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Pro 9 With 5g 1996	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Laptop 3 1867 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Laptop 3 1867	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Laptop 3 1872 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Laptop 3 1872	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Laptop 4 1958 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Laptop 4 1958	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Laptop 4 1950 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Laptop 4 1950	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Laptop 4 1952 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Laptop 4 1952	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Laptop 4 1978 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Laptop 4 1978	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Windows Dev Kit Firmware	All versions

Running on/with	Platform Versions
Microsoft Windows Dev Kit	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Hub 3 50 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Hub 3 50	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Pro 8 1983 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Pro 8 1983	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Pro 8 For Business With Lte Advanced 1982 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Pro 8 For Business With Lte Advanced 1982	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Hub 3 85 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Hub 3 85	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Hub 2s 85 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Hub 2s 85	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Go 3 1926 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Go 3 1926	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Go 3 1901 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Go 3 1901	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Go 3 2022 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Go 3 2022	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Go 2 1926 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Go 2 1926	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Go 2 1901 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Go 2 1901	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Surface Go 2 1927 Firmware	All versions

Running on/with	Platform Versions
Microsoft Surface Go 2 1927	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21194

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.