First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2025-21247

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-212488.8Windows Telephony Service Remote Code Execution Vulnerability CVE-2025-212496.6Windows Digital Media Elevation of Privilege Vulnerability CVE-2025-21254.3A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the f CVE-2025-212508.8Windows Telephony Service Remote Code Execution Vulnerability CVE-2025-212517.5Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability CVE-2025-212528.8Windows Telephony Service Remote Code Execution Vulnerability CVE-2025-212535.3Microsoft Edge for IOS and Android Spoofing Vulnerability CVE-2025-212546.5Internet Connection Sharing (ICS) Denial of Service Vulnerability CVE-2025-212556.6Windows Digital Media Elevation of Privilege Vulnerability CVE-2025-212566.6Windows Digital Media Elevation of Privilege Vulnerability CVE-2025-212575.5Windows WLAN AutoConfig Service Information Disclosure Vulnerability CVE-2025-212586.6Windows Digital Media Elevation of Privilege Vulnerability

CVE-2025-21247: Medium severity, CVSS 4.3 | Vulnix