CVE-2026-25250: CWE-325 Missing Cryptographic Step in eazsolution EazyFix

EAZ EazyFix 12.9 contains a security feature bypass vulnerability classified as CWE-325 (Missing Cryptographic Step). This flaw relates to the improper handling of Secure Boot disablement, allowing an attacker with high privileges and local access to potentially compromise confidentiality and integrity of the system. The CVSS 3.1 vector indicates low attack complexity, required high privileges, no user interaction, and unchanged scope. No vendor advisory details a fix or mitigation at this time.

The vulnerability allows bypassing security features tied to Secure Boot, potentially exposing sensitive information or enabling unauthorized integrity modifications. The impact affects confidentiality and integrity but does not affect availability. Exploitation requires local access with high privileges, limiting the attack surface. No active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25250 for current remediation guidance. Until an official fix is released, restrict local access to trusted users with high privileges and monitor for any unusual activity related to Secure Boot settings.