Product:
Virtual Secure Mode
Summary
Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally. This vulnerability can lead to unauthorized access and manipulation of sensitive information. Attackers with local access can exploit this flaw to impersonate legitimate users.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2025-48813 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system and utilize a key that has expired. By doing so, they can perform spoofing attacks, potentially gaining unauthorized access to sensitive data or systems. The high attack complexity indicates that the attacker must have specific conditions met to successfully exploit the vulnerability.
Affected Products
- Virtual Secure Mode: A security feature that isolates sensitive operations from the rest of the system, which can be compromised if keys are used past their expiration.
Mitigation
To mitigate this vulnerability, it is essential to ensure that all keys used in Virtual Secure Mode are regularly updated and monitored for expiration. Implementing strict access controls and auditing can help prevent unauthorized local access. Additionally, applying security updates from Microsoft can address this issue.