40
- شناسه CVE-2025-21389 :CVE
- CWE-400 :CWE
- yes :Advisory
- منتشر شده: ژانویه 14, 2025
- به روز شده: ژانویه 24, 2025
- امتیاز: 7.5
- وضعیتPublished :CVE
- No :POC
- وضعیت آسیب پذیری: patch شده
چکیده
این آسیب پذیری در ویندوز پیدا شده است. این آسیب پذیری یک عملکرد ناشناخته در کتابخانه upnphost.dll است. دستکاری منجر به مصرف منابع می شود. حمله را می توان از راه دور راه اندازی کرد.
توضیحات
این آسیب‌پذیری به مشکل مصرف منابع بیش از حد (Resource Consumption) مربوط است و در طبقه‌بندی امنیتی به عنوان
CWE-400 شناخته می‌شود. کتابخانه upnphost.dll نمی‌تواند به‌درستی منابع سیستمی (مانند حافظه یا پردازنده) را کنترل و مدیریت کند. یک مهاجم می‌تواند با ارسال ورودی‌های خاص، باعث مصرف بیش از حد منابع شود. این موضوع می‌تواند منجر به از کار افتادن سیستم (Denial of Service – DoS) شود، زیرا منابع کافی برای عملکرد صحیح سیستم باقی نمی‌ماند. این آسیب‌پذیری مستقیماً روی در دسترس بودن سیستم (Availability) تأثیر می‌گذارد و ممکن است باعث کند شدن یا غیرفعال شدن سیستم شود. بهره‌برداری از آن آسان است و نیازی به احراز هویت ندارد. کاربران باید سریعاً پچ امنیتی منتشرشده توسط مایکروسافت را نصب کنند تا این مشکل رفع شود.
CVSS
| Score | Severity | Version | Vector String | ||
| 7.5 | HIGH | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C | ||
لیست محصولات آسیب پذیر
| version | platform | product |
| affected from 10.0.17763.0 before 10.0.17763.6775 | 32-bit Systems, x64-based Systems | Windows 10 Version 1809 |
| affected from 10.0.17763.0 before 10.0.17763.6775
|
x64-based Systems | Windows Server 2019 |
| affected from 10.0.17763.0 before 10.0.17763.6775 | x64-based Systems | Windows Server 2019 (Server Core installation) |
| affected from 10.0.20348.0 before 10.0.20348.3091 | x64-based Systems | Windows Server 2022 |
| affected from 10.0.19043.0 before 10.0.19044.5371 | 32-bit Systems, ARM64-based Systems, x64-based Systems | Windows 10 Version 21H2 |
| affected from 10.0.22621.0 before 10.0.22621.4751 | ARM64-based Systems, x64-based Systems | Windows 11 version 22H2 |
| affected from 10.0.19045.0 before 10.0.19045.5371 | x64-based Systems, ARM64-based Systems, 32-bit Systems | Windows 10 Version 22H2 |
| affected from 10.0.26100.0 before 10.0.26100.2894 | x64-based Systems | Windows Server 2025 (Server Core installation) |
| affected from 10.0.22631.0 before 10.0.22631.4751 | ARM64-based Systems | Windows 11 version 22H3 |
| affected from 10.0.22631.0 before 10.0.22631.4751 | x64-based Systems | Windows 11 Version 23H2 |
| affected from 10.0.25398.0 before 10.0.25398.1369 | x64-based Systems | Windows Server 2022, 23H2 Edition (Server Core installation) |
| affected from 10.0.26100.0 before 10.0.26100.2894 | ARM64-based Systems, x64-based Systems | Windows 11 Version 24H2 |
| affected from 10.0.26100.0 before 10.0.26100.2894 | x64-based Systems | Windows Server 2025 |
| affected from 10.0.10240.0 before 10.0.10240.20890 | 32-bit Systems, x64-based Systems | Windows 10 Version 1507 |
| affected from 10.0.14393.0 before 10.0.14393.7699 | 32-bit Systems, x64-based Systems | Windows 10 Version 1607 |
| affected from 10.0.14393.0 before 10.0.14393.7699 | x64-based Systems | Windows Server 2016 |
| affected from 10.0.14393.0 before 10.0.14393.7699 | x64-based Systems | Windows Server 2016 (Server Core installation) |
| affected from 6.0.6003.0 before 6.0.6003.23070 | 32-bit Systems | Windows Server 2008 Service Pack 2 |
| affected from 6.0.6003.0 before 6.0.6003.23070 | 32-bit Systems, x64-based Systems | Windows Server 2008 Service Pack 2 (Server Core installation) |
| affected from 6.0.6003.0 before 6.0.6003.23070 | x64-based Systems | Windows Server 2008 Service Pack 2 |
| affected from 6.1.7601.0 before 6.1.7601.27520 | x64-based Systems | Windows Server 2008 R2 Service Pack 1 |
| affected from 6.1.7601.0 before 6.1.7601.27520 | x64-based Systems | Windows Server 2008 R2 Service Pack 1 (Server Core installation) |
| affected from 6.2.9200.0 before 6.2.9200.25273 | x64-based Systems | Windows Server 2012 |
| affected from 6.2.9200.0 before 6.2.9200.25273 | x64-based Systems | Windows Server 2012 (Server Core installation) |
| affected from 6.3.9600.0 before 6.3.9600.22371 | x64-based Systems | Windows Server 2012 R2 |
| affected from 6.3.9600.0 before 6.3.9600.22371 | x64-based Systems | Windows Server 2012 R2 (Server Core installation) |
لیست محصولات بروز شده
| Product | Impact | Max Severity | Build Number |
| Windows 10 Version 22H2 for 32-bit Systems | Denial of Service | Important | 10.0.19045.5371 |
| Windows 10 Version 22H2 for ARM64-based Systems | Denial of Service | Important | 10.0.19045.5371 |
| Windows 10 Version 22H2 for x64-based Systems | Denial of Service | Important | 10.0.19045.5371 |
| Windows 11 Version 22H2 for x64-based Systems | Denial of Service | Important | 10.0.22621.4751 |
| Windows 11 Version 22H2 for ARM64-based Systems | Denial of Service | Important | 10.0.22621.4751 |
| Windows 10 Version 21H2 for x64-based Systems | Denial of Service | Important | 10.0.19044.5371 |
| Windows 10 Version 21H2 for ARM64-based Systems | Denial of Service | Important | 10.0.19044.5371 |
| Windows 10 Version 21H2 for 32-bit Systems | Denial of Service | Important | 10.0.19044.5371 |
| Windows Server 2022 (Server Core installation) | Denial of Service | Important | 10.0.20348.3091 |
| Windows Server 2022 | Denial of Service | Important | 10.0.20348.3091 |
| Windows Server 2019 (Server Core installation) | Denial of Service | Important | 10.0.17763.6775 |
| Windows Server 2019 | Denial of Service | Important | 10.0.17763.6775 |
| Windows 10 Version 1809 for x64-based Systems | Denial of Service | Important | 10.0.17763.6775 |
| Windows 10 Version 1809 for 32-bit Systems | Denial of Service | Important | 10.0.17763.6775 |
| Windows Server 2012 R2 (Server Core installation) | Denial of Service | Important | 6.3.9600.22371 |
| Windows Server 2012 R2 | Denial of Service | Important | 6.3.9600.22371 |
| Windows Server 2012 (Server Core installation) | Denial of Service | Important | 6.2.9200.25273 |
| Windows Server 2012 | Denial of Service | Important | 6.2.9200.25273 |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | Denial of Service | Important | 6.1.7601.27520 |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | Denial of Service | Important | 6.1.7601.27520 |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 | Denial of Service | Important | 6.1.7601.27520 |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 | Denial of Service | Important | 6.1.7601.27520 |
| Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | Denial of Service | Important | 6.0.6003.23070 |
| Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | Denial of Service | Important | 6.0.6003.23070 |
| Windows Server 2008 for x64-based Systems Service Pack 2 | Denial of Service | Important | 6.0.6003.23070 |
| Windows Server 2008 for x64-based Systems Service Pack 2 | Denial of Service | Important | 6.0.6003.23070 |
| Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | Denial of Service | Important | 6.0.6003.23070 |
| Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | Denial of Service | Important | 6.0.6003.23070 |
| Windows Server 2008 for 32-bit Systems Service Pack 2 | Denial of Service | Important | 6.0.6003.23070 |
| Windows Server 2008 for 32-bit Systems Service Pack 2 | Denial of Service | Important | 6.0.6003.23070 |
| Windows Server 2016 (Server Core installation) | Denial of Service | Important | 10.0.14393.7699 |
| Windows Server 2016 | Denial of Service | Important | 10.0.14393.7699 |
| Windows 10 Version 1607 for x64-based Systems | Denial of Service | Important | 10.0.14393.7699 |
| Windows 10 Version 1607 for 32-bit Systems | Denial of Service | Important | 10.0.14393.7699 |
| Windows 10 for x64-based Systems | Denial of Service | Important | 10.0.10240.20890 |
| Windows 10 for 32-bit Systems | Denial of Service | Important | 10.0.10240.20890 |
| Windows Server 2025 | Denial of Service | Important | 10.0.26100.2894 |
| Windows 11 Version 24H2 for x64-based Systems | Denial of Service | Important | 10.0.26100.2894 |
| Windows 11 Version 24H2 for ARM64-based Systems | Denial of Service | Important | 10.0.26100.2894 |
| Windows Server 2022, 23H2 Edition (Server Core installation) | Denial of Service | Important | 10.0.25398.1369 |
| Windows 11 Version 23H2 for x64-based Systems | Denial of Service | Important | 10.0.22631.4751 |
| Windows 11 Version 23H2 for ARM64-based Systems | Denial of Service | Important | 10.0.22631.4751 |
| Windows Server 2025 (Server Core installation) | Denial of Service | Important | 10.0.26100.2894 |
منابع
- https://www.cve.org/CVERecord?id=CVE-2025-21389
- https://www.cvedetails.com/cve/CVE-2025-21389/
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21389
- https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-21389
- https://vuldb.com/?id.291804
- https://cwe.mitre.org/data/definitions/400.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-21389
