What is the CVSS score of CVE-2025-25210?

CVE-2025-25210 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ring are affected by CVE-2025-25210?

CVE-2025-25210 is a privilege escalation vulnerability in Server Firmware Update Utility affecting systems before version 16.0.12, with no patch currently available.

How to fix or mitigate CVE-2025-25210?

Within 24 hours: Inventory all systems running SysFwUpdt versions prior to 16.0.12 and restrict administrative access to firmware update utilities to verified personnel only. Within 7 days: Implement enhanced logging and monitoring for firmware update activities, and establish network segmentation to isolate affected systems where possible. Within 30 days: Prepare for immediate patch deployment upon vendor release and establish a vendor communication channel for CVE-2025-25210 updates.

Ring CVE-2025-25210

HIGH

Improper Input Validation (CWE-20)

2026-02-10 secure@intel.com

Privilege Escalation

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 17:16 nvd

HIGH 8.2

DescriptionCVE.org

Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

AnalysisAI

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confid

Affected ProductsAI

Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an esca