CVE-2025-21207 HIGH

CVE-2025-21207: Windows Connected Devices Platform Service (Cdpsvc) Denial of Service Vulnerability

Vendor Microsoft
Product Windows 10 Version 1809
Weakness CWE-400
Published January 14, 2025
Last update June 9, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

What the vulnerability does

01Description

Windows Connected Devices Platform Service (Cdpsvc) Denial of Service Vulnerability

Key dates

02Disclosure timeline

January 14, 2025 CVE published
June 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-54712 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion CVE-2026-54260 Wagtail: Denial of service via unbounded filter specs in the image preview CVE-2026-41842 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux CVE-2026-11790 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service CVE-2026-54399 Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration