विंडोज वेब थ्रेट डिफेंस यूजर सर्विस सूचना प्रकटीकरण भेद्यता

Successful exploitation of CVE-2025-21343 could allow an attacker to gain unauthorized access to sensitive data processed by the Windows Web Threat Defense User Service. The specific data exposed depends on the service's configuration and the data it handles, but could include user credentials, network configurations, or other confidential information. While the vulnerability is classified as Information Disclosure, the potential for data compromise could lead to further attacks, such as privilege escalation or data exfiltration. The blast radius is limited to systems running the affected versions of Windows and utilizing the Web Threat Defense User Service.

Organizations utilizing the Windows Web Threat Defense User Service, particularly those with legacy Windows 10 deployments or those who have not consistently applied security updates, are at increased risk. Systems with weak network segmentation or inadequate monitoring capabilities are also more vulnerable.

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-WebThreatDefenseUserService']]]" | Where-Object {$_.Level -eq 2}

• windows / supply-chain:

Get-Process -Name WebThreatDefenseUserSvc -ErrorAction SilentlyContinue

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*WebThreatDefense*'} | Format-List TaskName, State

1. 2025-01-14Disclosure

   disclosure

1. आरक्षित2024-12-11
2. प्रकाशित2025-01-14
3. संशोधित2026-02-13
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2025-21343 is to upgrade to Windows version 10.0.26100.2894 or later, which includes the security update that resolves the vulnerability. If immediate patching is not feasible, consider implementing network segmentation to limit the potential impact of a successful exploit. Monitor network traffic for unusual activity related to the Web Threat Defense User Service. While no specific WAF rules are available, general rules to detect unusual data access patterns could be helpful.