CVE-2025-27461

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

During startup, the device automatically logs in the EPC2 Windows user without requesting a password.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-274629.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindoCVE-2025-274639.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindowsCVE-2025-274649.4[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The WindowsCVE-2025-274654.3Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executablCVE-2025-274669.8[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-274677.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-274687.0Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2025-274697.5Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service ovCVE-2025-27479.8An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handCVE-2025-274707.5Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service overCVE-2025-274715.9Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a netCVE-2025-274725.4Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2025-27461: Medium severity, CVSS 6.8 | Vulnix