Windows リモートアクセス接続マネージャーにおける権限昇格の脆弱性

Successful exploitation of CVE-2025-47955 allows an attacker who has already gained some level of access to a system to significantly escalate their privileges. This could enable them to gain SYSTEM-level access, granting them complete control over the compromised machine. An attacker could then install malware, steal sensitive data, modify system configurations, or pivot to other systems on the network. The impact is particularly severe in environments where user accounts have elevated privileges or where Remote Access Connection Manager is used to manage connections for privileged users. This vulnerability shares similarities with other privilege escalation flaws where improper access controls are exploited to gain higher permissions.

Organizations using Windows 10 and earlier versions, particularly those with legacy systems or configurations that rely heavily on Remote Access Connection Manager, are at risk. Shared hosting environments where multiple users share a single server are also vulnerable, as a compromised user account could be leveraged to escalate privileges and impact other users.

• windows / supply-chain:

Get-WinEvent -LogName Security -Filter "EventID = 4624 -MessageText '* privilege escalation*'"

• windows / supply-chain:

Get-Process -ErrorAction SilentlyContinue | Where-Object {$_.TokenElevationType -eq 'TokenElevationTypeFull'}

• windows / supply-chain: Check Autoruns for unusual entries related to Remote Access Connection Manager. • windows / supply-chain: Monitor Windows Defender for alerts related to privilege escalation attempts.

1. 2025-06-10Disclosure

   disclosure

1. 予約済み2025-05-14
2. 公開日2025-06-10
3. 更新日2026-02-20
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-47955 is to upgrade the Windows Remote Access Connection Manager to version 10.0.26100.4061 or later. If immediate patching is not possible, consider implementing least privilege principles to restrict user access and limit the potential impact of a successful exploit. Review existing group policies and user account permissions to ensure they adhere to the principle of least privilege. While a direct workaround isn't available, monitoring for suspicious privilege escalation attempts is crucial. After upgrading, confirm the fix by attempting to execute a process with a lower privilege level and verifying that it is denied.