CVE-2025-21056
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In Retail Mode prior to version 5.59.4, improper input validation allows attackers to execute privileged commands on their own devices.
Risk Assessment
An attacker can gain elevated privileges on their device, potentially leading to system integrity compromise or privilege escalation.
Recommendation
Update the system to version 5.59.4 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Retail Mode
See all- CVE-2026-21010Medium
Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.
- CVE-2025-21065Medium
Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.
Original NVD description (English source)
Improper input validation in Retail Mode prior to version 5.59.4 allows self attackers to execute privileged commands on their own devices.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS