OnlyPatch
Network Connection Status Indicator (NCSI)

CVE-2025-59201 — Network Connection Status Indicator (NCSI) Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.00415 🔬 Patch diffed 2025-10 archive

Executive Summary

Improper access control in Network Connection Status Indicator (NCSI) allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-284: Improper Access Control
Released Oct 14 2025
Last Updated Oct 14 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00415 — 0.34444 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.00415
probability of exploitation in the next 30 days
0.34444 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

33 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5066837 (Security Update) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5066837 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5066836 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5066836 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5066586 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5066586 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5066791 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5066793 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5066793 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5066793 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5066793 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5066835 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5066835 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for ARM64-based Systems 5066835 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for x64-based Systems 5066835 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5066874 (Monthly Rollup) 5066877 (Security Only) Important Elevation of Privilege 5065508 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23571 Yes None Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5066874 (Monthly Rollup) 5066877 (Security Only) Important Elevation of Privilege 5065508 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23571 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 5066874 (Monthly Rollup) 5066877 (Security Only) Important Elevation of Privilege 5065508 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23571 Yes None Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5066874 (Monthly Rollup) 5066877 (Security Only) Important Elevation of Privilege 5065508 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.23571 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 5066872 (Monthly Rollup) 5066876 (Security Only) Important Elevation of Privilege 5065468 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27974 Yes None Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5066872 (Monthly Rollup) 5066876 (Security Only) Important Elevation of Privilege 5065468 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.27974 Yes None Windows Server 2012 5066875 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5066875 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5066873 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5066873 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5066836 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5066836 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5066586 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5066586 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5066782 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5066782 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5066780 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 5066835 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 (Server Core installation) 5066835 (Security Update) Important Elevation of Privilege Yes

Patches

10 patches
Article Type Restart
5066837 Security Update Yes
5066836 Security Update Yes
5066586 Security Update Yes
5066791 Security Update Yes
5066793 Security Update Yes
5066835 Security Update Yes
5066875 Monthly Rollup Yes
5066873 Monthly Rollup Yes
5066782 Security Update Yes
5066780 Security Update Yes

Patch Diff

ghidriff + headless Ghidra decompile verification · ncsi.dll (KB5066835)

EoP to NETWORK SERVICE (CWE-284 Improper Access Control) in the Network List Service (netprofm) NCSI module. Any local user can forge the Microsoft-Windows-WinINet-Config ETW event 5600 ({5402e5ea-1bdd-4390-82be-e108f1e634f5}); ncsi!EtwListener::ProcessEvent funnels attacker strings into ncsi!StoreNcsiIEProxyString, which RegSetValueExW-s '<0|1><string>' into HKLM\...\NlaSvc\Parameters\Internet\ManualProxies with no validation. Combined with the pre-patch DACL on ...\NlaSvc\Parameters (INTERACTIVE could create subkeys -> registry key symbolic link), the coerced NETWORK SERVICE write lands at an arbitrary HKLM location; NETWORK SERVICE -> SYSTEM is a known step (Forshaw). Patch KB5066835 (ncsi.dll 10.0.26100.6899) adds ContainsRelativePathDoubleDot behind Feature_3499399482 AND tightens the registry DACL. VERIFIED 2026-07-22 via ghidriff + headless decompile (single code-changed function).

Pre-patch version 10.0.26100.6725 Download
Post-patch version 10.0.26100.6899 Download
Function Address Change Note
ncsi!StoreNcsiIEProxyString 0x1800546d0 (pre) / 0x1800549f0 (post) code (verified via headless decompile 2026-07-22) Builds '<0|1><attacker string>' and RegSetValueExW-s it into the default value of HKLM\...\NlaSvc\Parameters\Internet\ManualProxies with NO input validation. Reached from ncsi!EtwListener::ProcessEvent via forged Microsoft-Windows-WinINet-Config ETW event 5600 (any local user). Fix: behind WIL flag Feature_3499399482, write only happens if ContainsRelativePathDoubleDot(input) is false ('..' strings dropped). NOTE: binary fix is only half the story — KB5066835 also removed INTERACTIVE create-subkey from the DACL on ...\NlaSvc\Parameters, the actual root cause (registry key symlink -> coerced NETWORK SERVICE write to arbitrary HKLM) per itm4n.
ncsi!ContainsRelativePathDoubleDot 0x180053294 added wcsstr(input, L'..') != NULL + WPP tracing; gates the registry write
Feature_3499399482 WIL plumbing (+ 5 more added) added CFR kill-switch for the new validation block
View full diff report View RCA report Download PoC

Attack Path

Any local user can forge an ETW event that the Network List Service trusts as configuration input

Attack path for CVE-2025-59201 Any local user can forge an ETW event that the Network List Service trusts as configuration input 01 — ENTRY Local user writes a Microsoft-Windows-WinINet-Config ETW event 5600 Provider GUID {5402e5ea-1bdd-4390-82be-e108f1e634f5}. ETW providers can be written by unprivileged processes; netprofm consumes them as NETWORK SERVICE. 02 — CONTROLLED INPUT The event payload carries an attacker-chosen proxy string ncsi!EtwListener::ProcessEvent funnels the string straight through to the storage helper. 03 — PATH ncsi!StoreNcsiIEProxyString writes it to the registry It builds '<0|1><attacker string>' and RegSetValueExW's it into the default value of HKLM\...\NlaSvc\Parameters\Internet\ManualProxies. 04 — MISSING CHECK The only gate is a '..' substring scan, and there is no authentication of the event source ncsi!ContainsRelativePathDoubleDot does wcsstr(input, L'..') and nothing else - it does not establish that the event came from a trusted producer. CWE-284. 05 — PRIMITIVE Attacker-controlled value written under HKLM by NETWORK SERVICE Elevation to NETWORK SERVICE with a write into a machine-wide configuration key that other components read back.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

T0

On This Page