CVE-2025-47955: Windows 10 1507 Privilege Escalation Flaw

CVE-2025-47955 Overview

CVE-2025-47955 is a local privilege escalation vulnerability in the Windows Remote Access Connection Manager (RasMan) service. Microsoft attributes the flaw to improper privilege management [CWE-269]. An authenticated local attacker can abuse the service to elevate privileges on affected systems.

The issue spans nearly every supported Windows client and server release, from Windows 10 1507 through Windows 11 24H2, and Windows Server 2008 through Windows Server 2025. Successful exploitation grants an attacker the ability to run code with higher privileges, potentially SYSTEM, from a low-privileged account context.

Critical Impact
A local, authenticated attacker can gain SYSTEM-level privileges through the RasMan service, resulting in full compromise of confidentiality, integrity, and availability on the host.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-06-10 - CVE-2025-47955 published to NVD and disclosed via Microsoft Security Update Guide
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47955

Vulnerability Analysis

The Remote Access Connection Manager (RasMan) service manages dial-up and virtual private network (VPN) connections on Windows. It runs as a SYSTEM-level service and exposes interfaces that lower-privileged users can interact with to create, modify, and initiate connections.

Microsoft classifies the weakness as improper privilege management [CWE-269]. In practical terms, the service performs one or more actions on behalf of a caller without sufficiently validating whether the caller should have the resulting privilege. An authenticated local attacker who can reach the RasMan interface can leverage this gap to execute operations at a higher integrity level than their own token allows.

Because the CVSS vector reflects local attack access with low privileges required and no user interaction, the vulnerability is well-suited to post-compromise activity by malware or a hands-on-keyboard adversary who already has a foothold as a standard user.

Root Cause

The root cause is inadequate privilege enforcement within the RasMan service's handling of caller-supplied input or object references. Windows services that broker configuration objects for VPN and RAS phonebook entries must strictly separate caller privileges from the SYSTEM context they operate in. When that separation is incomplete, a low-privileged caller can influence privileged actions such as file writes, registry modifications, or code loading paths that RasMan performs.

Attack Vector

Exploitation requires local access and an authenticated user account on the target. The attacker interacts with the RasMan service using its documented client interfaces, then coerces the service into performing an operation that yields elevated privileges. No user interaction is required beyond the attacker's own actions. Microsoft has not disclosed proof-of-concept code, and no public exploit is currently listed in Exploit-DB or CISA KEV.

Refer to the Microsoft CVE-2025-47955 Update Guide for vendor technical details.

Detection Methods for CVE-2025-47955

Indicators of Compromise

Unexpected creation or modification of RAS phonebook files (rasphone.pbk) under %ProgramData%\Microsoft\Network\Connections\Pbk\ or user profile paths by non-administrative users.
New or altered VPN connection profiles referencing unusual custom scripts, DLLs, or connection actions.
Child processes spawned by svchost.exe hosting the RasMan service that execute binaries from user-writable directories.

Detection Strategies

Monitor Windows Service Control Manager and RasMan event logs (Application and Services Logs\Microsoft\Windows\RasClient) for anomalous configuration changes originating from standard user sessions.
Alert on process ancestry where svchost.exe -k netsvcs (RasMan) spawns interactive shells, script interpreters, or binaries from non-system paths.
Correlate token elevation events (Event ID 4672) with preceding RasMan API activity from low-privileged accounts.

Monitoring Recommendations

Enable Windows process creation auditing with command-line logging (Event ID 4688) to surface suspicious RasMan-initiated child processes.
Track modifications to registry keys under HKLM\SYSTEM\CurrentControlSet\Services\RasMan and related RAS configuration hives.
Baseline normal VPN client behavior on endpoints so that anomalous phonebook or profile writes stand out for investigation.

How to Mitigate CVE-2025-47955

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft CVE-2025-47955 Update Guide to all affected Windows client and server systems.
Prioritize patching on multi-user systems such as terminal servers, jump hosts, and shared workstations where local privilege escalation has the highest impact.
Audit local user accounts and remove unnecessary interactive logon rights to reduce the pool of accounts that can trigger the vulnerability.

Patch Information

Microsoft has released security updates for all impacted Windows versions through the standard monthly servicing channel. Administrators should consult the vendor advisory for the specific KB numbers that apply to each build and deploy them via Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager. Systems on unsupported builds such as unpatched Windows Server 2008 require extended support coverage to receive the fix.

Workarounds

If patching must be delayed on non-critical systems, consider disabling the RasMan service where VPN and dial-up functionality is not required, and validate that dependent applications still function.
Restrict local logon rights via Group Policy so only trusted accounts can authenticate to affected hosts.
Deploy application control policies (Windows Defender Application Control, AppLocker) to block execution of unauthorized binaries from user-writable directories that could be leveraged in a RasMan exploit chain.

bash

# Configuration example: query and, if operationally acceptable, disable RasMan as a temporary workaround
sc.exe query RasMan
sc.exe config RasMan start= disabled
sc.exe stop RasMan