Microsoft has addressed four elevation of privilege vulnerabilities in its Windows Defender Firewall service, all rated as “Important” in severity.
The security flaws were detailed in Microsoft’s September 9, 2025, security update release. If exploited, these vulnerabilities could allow an authenticated attacker to gain higher privileges on an affected system.
The four vulnerabilities are tracked as CVE-2025-53808, CVE-2025-54104, CVE-2025-54109, and CVE-2025-54915. All four enable a local attacker to escalate their privileges, posing a significant risk to system integrity.
At the time of disclosure, Microsoft stated that none of the vulnerabilities had been publicly disclosed or actively exploited in the wild.
Nature Of The Firewall Vulnerabilities
Three of the four vulnerabilities (CVE-2025-54104, CVE-2025-54109, and CVE-2025-54915) are caused by a “type confusion” flaw within the Windows Defender Firewall Service.
Type confusion is a common class of memory safety bug where a program attempts to access a resource with an incompatible type, leading to unexpected and often insecure behavior.
In this case, it allows an authorized attacker to trigger a condition that leads to local privilege escalation.
The fourth vulnerability, CVE-2025-53808, is also a service elevation of privilege flaw, though Microsoft’s advisory does not specify it as a type confusion bug.
The common thread among all four is the potential outcome: a low-privileged user gaining elevated system rights.
Understanding The Attack Scenario
To exploit any of these vulnerabilities, an attacker must first have authenticated access to the target machine. Furthermore, exploitation requires the attacker’s account to be a member of a specific, restricted user group.
This high prerequisite is reflected in the CVSS metric “Privileges Required: High (PR:H),” indicating that a casual or unauthenticated attacker cannot leverage these flaws.
A successful exploit would allow the attacker to elevate their privileges from a “Medium Integrity Level” to “Local Service.”
While not full system or administrator-level control, gaining Local Service privileges provides significant capabilities, allowing an attacker to access and manipulate a wide range of system resources, install malicious software, or further compromise the affected host.
Microsoft’s Assessment And Mitigation
Microsoft’s exploitability assessment indicates that an attack is “Less Likely” for CVE-2025-53808, CVE-2025-54104, and CVE-2025-54109.
For CVE-2025-54915, the assessment is even lower, at “Exploitation Unlikely.” This analysis is based on the high privileges required for an attacker to be in a position to exploit the flaws.
Despite the low likelihood of exploitation, the “Important” severity rating underscores the potential danger if an attacker meets the necessary prerequisites.
Microsoft has released security updates to patch these vulnerabilities across all affected versions of Windows.
System administrators and users are strongly advised to apply the September 2025 security updates promptly to protect their systems and mitigate the risk of potential privilege escalation attacks.
The post Windows Defender Firewall Vulnerabilities Let Attackers Escalate Privileges appeared first on Cyber Security News.
