CVE-2025-27460

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login. The attacker can read from and write to all files on the hard drives.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-312 CWE-326

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-274616.8During startup, the device automatically logs in the EPC2 Windows user without requesting a password.CVE-2025-274629.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windo CVE-2025-274639.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows CVE-2025-274649.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows CVE-2025-274654.3Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executabl CVE-2025-274669.8[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-274677.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-274687.0Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2025-274697.5Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service ov CVE-2025-27479.8An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password hand CVE-2025-274707.5Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over CVE-2025-274715.9Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a net