What is the CVSS score of CVE-2025-22453?

CVE-2025-22453 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ring are affected by CVE-2025-22453?

CVE-2025-22453 is a privilege escalation vulnerability in Server Firmware Update Utility affecting systems before version 16.0.12, with no patch currently available.

How to fix or mitigate CVE-2025-22453?

Within 24 hours: Inventory all systems running SysFwUpdt versions before 16.0.12 and restrict physical/remote administrative access to firmware update functions. Within 7 days: Disable SysFwUpdt if not actively required, or isolate affected systems from critical networks; establish monitoring for suspicious privilege escalation attempts. Within 30 days: Plan urgent migration to version 16.0.12 or later immediately upon vendor patch release; implement application whitelisting to restrict firmware utility execution.

Ring CVE-2025-22453

HIGH

Improper Input Validation (CWE-20)

2026-02-10 secure@intel.com

Privilege Escalation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 17:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

AnalysisAI

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confiden

Affected ProductsAI

Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an esca