CVE-2025-27488

Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability

State: Published
Severity: 6.7 Medium
Published: May 13, 2025
Updated: Feb 13, 2026
Reserved: Feb 26, 2025

Description

Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	microsoft

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
Windows 10 HLK version 20H2Microsoft	1.0.0 to before 10.1.19041.5609Affected
Windows 10 HLK version 21H1Microsoft	1.0.0 to before 10.1.19041.5609Affected
Windows 10 HLK version 21H2Microsoft	1.0.0 to before 10.1.19041.5609Affected
Windows 10 HLK Version 22H2Microsoft	1.0.0 to before 10.1.19041.5609Affected
Windows 11 HLK 22H2Microsoft	1.0.0 to before 10.1.22621.5040Affected
Windows 11 HLK 24H2Microsoft	1.0.0 to before 10.1.26100.3478Affected
Windows HLK for Windows 10 version 2004Microsoft	1.0.0 to before 10.1.19041.5609Affected
Windows HLK for Windows Server 2019Microsoft	1.0.0 to before 10.1.17763.7010Affected
Windows HLK for Windows Server 2022Microsoft	1.0.0 to before 10.1.20348.3330Affected
Windows HLK for Windows Server 2025Microsoft	1.0.0 to before 10.1.26100.3478Affected
Windows HLK, version 1809Microsoft	1.0.0 to before 10.1.17763.7010Affected

References

Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerabilityvendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.