CVE-2025-21194 [High] | Input Validation Bypass in Surface Hub 2s Firmware

CVE-2025-21194 is rated Moderate Risk (47.4/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.82%). Review affected assets and schedule remediation.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.20%	0.82%	+0.62%
2	2026-04-07	0.26%	0.20%	-0.06%
3	2026-04-06	—	0.26%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.20%

0.82%

+0.62%

2026-04-07

0.26%

0.20%

-0.06%

2026-04-06

—

0.26%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.1	3.1	HIGH	`CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:A) Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.2	5.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.1

3.1

HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:A): Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.2

5.9

[email protected]

Affected software / configurations for CVE-2025-21194

Vendor	Product	Version	Raw CPE
microsoft	surface_hub_2s_firmware	—	cpe:2.3:o:microsoft:surface_hub_2s_firmware:-:::::::*
microsoft	surface_pro_8_for_business_1983_firmware	—	cpe:2.3:o:microsoft:surface_pro_8_for_business_1983_firmware:-:::::::*
microsoft	surface_laptop_go_firmware	—	cpe:2.3:o:microsoft:surface_laptop_go_firmware:-:::::::*
microsoft	surface_laptop_go_2_firmware	—	cpe:2.3:o:microsoft:surface_laptop_go_2_firmware:-:::::::*
microsoft	surface_hub_3_50_firmware	—	cpe:2.3:o:microsoft:surface_hub_3_50_firmware:-:::::::*
microsoft	surface_pro_7\+_firmware	—	cpe:2.3:o:microsoft:surface_pro_7\+_firmware:-:::::::*
microsoft	surface_laptop_go_3_firmware	—	cpe:2.3:o:microsoft:surface_laptop_go_3_firmware:-:::::::*
microsoft	surface_go_3_firmware	—	cpe:2.3:o:microsoft:surface_go_3_firmware:-:::::::*
microsoft	surface_pro_9_with_5g_1997_firmware	—	cpe:2.3:o:microsoft:surface_pro_9_with_5g_1997_firmware:-:::::::*
microsoft	surface_pro_9_with_5g_1996_firmware	—	cpe:2.3:o:microsoft:surface_pro_9_with_5g_1996_firmware:-:::::::*
microsoft	surface_laptop_3_1867_firmware	—	cpe:2.3:o:microsoft:surface_laptop_3_1867_firmware:-:::::::*
microsoft	surface_laptop_3_1872_firmware	—	cpe:2.3:o:microsoft:surface_laptop_3_1872_firmware:-:::::::*
microsoft	surface_laptop_4_1958_firmware	—	cpe:2.3:o:microsoft:surface_laptop_4_1958_firmware:-:::::::*
microsoft	surface_laptop_4_1950_firmware	—	cpe:2.3:o:microsoft:surface_laptop_4_1950_firmware:-:::::::*
microsoft	surface_laptop_4_1952_firmware	—	cpe:2.3:o:microsoft:surface_laptop_4_1952_firmware:-:::::::*
microsoft	surface_laptop_4_1978_firmware	—	cpe:2.3:o:microsoft:surface_laptop_4_1978_firmware:-:::::::*
microsoft	windows_dev_kit_firmware	—	cpe:2.3:o:microsoft:windows_dev_kit_firmware:-:::::::*
microsoft	surface_hub_2s_85_firmware	—	cpe:2.3:o:microsoft:surface_hub_2s_85_firmware:-:::::::*
microsoft	surface_hub_3_85_firmware	—	cpe:2.3:o:microsoft:surface_hub_3_85_firmware:-:::::::*
microsoft	surface_pro_8_1983_firmware	—	cpe:2.3:o:microsoft:surface_pro_8_1983_firmware:-:::::::*
microsoft	surface_pro_8_for_business_with_lte_advanced_1982_firmware	—	cpe:2.3:o:microsoft:surface_pro_8_for_business_with_lte_advanced_1982_firmware:-:::::::*
microsoft	surface_go_3_1926_firmware	—	cpe:2.3:o:microsoft:surface_go_3_1926_firmware:-:::::::*
microsoft	surface_go_3_1901_firmware	—	cpe:2.3:o:microsoft:surface_go_3_1901_firmware:-:::::::*
microsoft	surface_go_3_2022_firmware	—	cpe:2.3:o:microsoft:surface_go_3_2022_firmware:-:::::::*
microsoft	surface_go_2_1926_firmware	—	cpe:2.3:o:microsoft:surface_go_2_1926_firmware:-:::::::*
microsoft	surface_go_2_1901_firmware	—	cpe:2.3:o:microsoft:surface_go_2_1901_firmware:-:::::::*
microsoft	surface_go_2_1927_firmware	—	cpe:2.3:o:microsoft:surface_go_2_1927_firmware:-:::::::*

References for CVE-2025-21194

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21194	Vendor Advisory

URL

CVE-2025-21194 | Microsoft Surface Security Feature Bypass Vulnerability

Exploit prediction scoring system (EPSS) score for CVE-2025-21194

Common vulnerability scoring system (CVSS) metrics for CVE-2025-21194

Weakness enumeration for CVE-2025-21194

Affected software / configurations for CVE-2025-21194

References for CVE-2025-21194