CVE-2025-21355

9.8

CRITICAL CVSS 3.1

Microsoft Bing Remote Code Execution Vulnerability

Description

Missing Authentication for Critical Function in Microsoft Bing allows an unauthorized attacker to execute code over a network

INFO

Published Date :

Feb. 19, 2025, 11:15 p.m.

Last Modified :

Feb. 19, 2025, 11:15 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Affected Products

The following products are affected by CVE-2025-21355 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Microsoft	bing

: Total Affected Vendor : 1 | Products : 1

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]
	CVSS 3.1	CRITICAL				[email protected]

Solution

Address missing authentication to prevent unauthorized code execution.

Implement robust authentication checks for critical functions.
Ensure all sensitive operations require proper authorization.
Review and enforce access controls rigorously.

Public PoC/Exploit Available at Github

CVE-2025-21355 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-21355.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21355

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-21355 is associated with the following CWEs:

CWE-306: Missing Authentication for Critical Function

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-21355 weaknesses.

CAPEC-12: Choosing Message Identifier Choosing Message Identifier CAPEC-36: Using Unpublished Interfaces or Functionality Using Unpublished Interfaces or Functionality CAPEC-62: Cross Site Request Forgery Cross Site Request Forgery CAPEC-166: Force the System to Reset Values Force the System to Reset Values CAPEC-216: Communication Channel Manipulation Communication Channel Manipulation

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

apiverve/news.Python-API

News API is a simple tool for scraping news data. It returns the news title, description, and more.

Python

Updated: 7 months ago

0 stars 0 fork 0 watcher

Born at : May 25, 2024, 9:36 a.m. This repo has been linked 3 different CVEs too.

apiverve/news-API

News API is a simple tool for scraping news data. It returns the news title, description, and more.

JavaScript

Updated: 7 months ago

0 stars 0 fork 0 watcher

Born at : May 13, 2024, 4:20 p.m. This repo has been linked 3 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-21355 vulnerability anywhere in the article.

The Register

Oops, some of our customers' Power Pages-hosted sites were exploited, says Microsoft

Microsoft has fixed a security flaw in its Power Pages website-building SaaS, after criminals got there first – and urged users to check their sites for signs of exploitation. Power Pages is part of M ...