CVE-2025-25059
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Uncontrolled search path in Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User Applications may allow an escalation of privilege. An unprivileged authenticated user with a high-complexity attack can escalate privileges via local access, requiring active user interaction.
Risk Assessment
This can lead to privilege escalation, potentially compromising confidentiality, integrity, and availability. It requires an authenticated user and high attack complexity, but the impact can be severe.
Recommendation
Update Intel(R) OFU to version 14.1.31 or later. Restrict user privileges and monitor local activity.
Other vulnerabilities in Intel(R) One Boot Flash Update (Intel(R) OFU)
Original NVD description (English source)
Uncontrolled search path for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS