CVE-2025-30185

HighCVSS 7.9/10Last modified Oct 19, 2026

Description

Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-301865.4Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be exCVE-2025-301873.7In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might bCVE-2025-301887.5Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is requirCVE-2025-301897.4When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be usCVE-2025-30197.2KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opeCVE-2025-301905.4Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the cCVE-2025-301915.4Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sensCVE-2025-301927.5An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries. CVE-2025-301937.5In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a clientCVE-2025-301947.5When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange thaCVE-2025-301957.5An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegaCVE-2025-301966.5Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme
CVE-2025-30185: High severity, CVSS 7.9 | Vulnix