Microsoft CVE-2025-7024

Q: What is the CVSS score of CVE-2025-7024?

CVE-2025-7024 has a CVSS 4.0 base score of 5.6 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-209201 MEDIUM

Incorrect Default Permissions (CWE-276)

2026-04-03 airbus

Privilege Escalation RCE Microsoft

5.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.6 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 03, 2026 - 07:45 euvd

EUVD-2025-209201

Analysis Generated

Apr 03, 2026 - 07:45 vuln.today

CVE Published

Apr 03, 2026 - 07:30 nvd

MEDIUM 5.6

DescriptionCVE.org

Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse.

An attacker may execute arbitrary code with SYSTEM privileges if a user is tricked or directed to place a crafted file into the vulnerable directory.

This issue affects TETRA connectivity Server: 7.0.

Vulnerability fix is available and delivered to impacted customers.

AnalysisAI

AIRBUS TETRA Connectivity Server 7.0 on Windows Server allows privilege escalation to SYSTEM via incorrect default directory permissions (CWE-276), enabling local authenticated attackers to execute arbitrary code by placing a crafted file in a vulnerable directory with user interaction. The vulnerability affects TETRA Connectivity Server version 7.0, with patches available for versions 8.0 and 9.0. No public exploit code or active exploitation in the wild has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper file system permissions on the Windows Server OS implementation of AIRBUS TETRA Connectivity Server. CWE-276 (Incorrect Default Permissions) describes a situation where a software component creates or uses a file without setting restrictive permissions, allowing unprivileged or less-privileged users to read, modify, or execute sensitive files. In this case, the TETRA Connectivity Server's installation directory or service directories are world-writable or writable by low-privileged users, permitting placement of crafted executables or DLL files that are subsequently executed with SYSTEM privileges. This is a classic Windows privilege escalation vector exploiting default NTFS permissions on application directories.

RemediationAI

Vendor-released patch: Upgrade TETRA Connectivity Server to version 8.0 or later, which includes the corrective fix. Organizations unable to upgrade immediately should restrict file system permissions on the TCS installation and service directories to prevent unprivileged users from writing executable or library files. Apply principle of least privilege to directory ACLs, ensuring only SYSTEM and the TCS service account have write access. Monitor for unauthorized file creation attempts in TCS directories. Coordinate with AIRBUS support (per ENISA EUVD-2025-209201) to obtain and validate the patch delivery for your environment.