Product:
Windows Hello
Summary
Cleartext transmission of sensitive information in Windows Hello allows an unauthorized attacker to bypass a security feature locally. This vulnerability poses a significant risk as it can lead to unauthorized access to sensitive data. Attackers can exploit this weakness without requiring any special privileges.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.7 | CVE-2025-53139 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected system. By intercepting the cleartext transmission of sensitive information, the attacker can bypass security features and gain unauthorized access to user data. This can be achieved through various local attack vectors, making it crucial for users to secure their devices.
Affected Products
- Windows Hello: A biometric authentication feature that allows users to log in using facial recognition or fingerprints.
Mitigation
To mitigate this vulnerability, users should ensure that their systems are updated with the latest security patches from Microsoft. Additionally, employing strong local security measures and restricting physical access to devices can help reduce the risk of exploitation.