What’s New Wednesday: January 2025 January 15, 2025 – Posted in: IT Support, News, What's New Wednesdays – Tags: it support, Patch Tuesday, patching, SoftwareSupport, WhatsNewWednesday

Happy New Year! The first Patch Tuesday of 2025 was a whopper with 159 flaws patched including 8 zero-day vulnerabilities, 3 of which have been actively exploited. It’s a good idea to restart your PC today and we may well restart some of your servers overnight this week if a patch requires it.

NEW THIS WEDNESDAY

Overall Microsoft patched:

• 14 Security Feature Bypass Vulnerabilities
• 58 Remote Code Execution Vulnerabilities
• 24 Information Disclosure Vulnerabilities
• 20 Denial of Service Vulnerabilities
• 5 Spoofing Vulnerabilities

There were 4 actively exploited or publicly disclosed zero-day vulnerabilities patched:
CVE-2025-21333, CVE-2025-21334, CVE-2025-21335 – Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Microsoft has fixed 3 elevation of privilege vulnerabilities in Windows Hyper-V that were exploited in attacks to gain SYSTEM privileges.

CVE-2025-21275 – Windows App Package Installer Elevation of Privilege Vulnerability
Microsoft fixed an elevation of privileges flaw in the Windows App Package Installer that could lead to SYSTEM privileges.

CVE-2025-21308 – Windows Themes Spoofing Vulnerability
Microsoft fixed a Windows Theme vulnerability that could be exploited by displaying a specific Theme file in Windows Explorer. A malicious actor would have to convince the user to load a file onto a vulnerable system, usually via an email or IM message and convince them to apply it – though the user didn’t need to open the file. The malicious actor can then use the file to steal NTLM credentials.

CVE-2025-21186, CVE-2025-21366, CVE-2025-21395 – Microsoft Access Remote Code Execution Vulnerability
Microsoft mitigated 3 remote code execution vulnerabilities in Microsoft Access that are exploited when opening malicious Microsoft Access documents by blocking access to vulnerable Microsoft Access documents if they were sent via email.

Releases from other software providers include:

• Adobe – updates for numerous products, including Photoshop, Commerce, Illustrator, InDesign, and more.
• CISA – advisories on industrial control system vulnerabilities in MOBATIME, Schneider Electric, National Instruments, Horner Automation, Rockwell Automation, and Ruijie.
• Cleo – security file transfer is impacted by an actively exploited zero-day used in data theft attacks.
• Cisco – security updates for multiple products including Cisco NX-OS and Cisco ASA.
• IO-Data – zero-day router flaws exploited in attacks to take over devices.
• 0patch – an unofficial patch for a Windows zero-day vulnerability that impacts all Windows versions from Windows 7 and Server 2008 R2 up to the latest Windows 11 24H2 and Server 2022 and allows attackers to capture NTLM credentials.
• OpenWrt – security updates for a Sysupgrade flaw that allowed attackers to distribute malicious firmware images.
• SAP – security updates for multiple products.
• Veeam – security updates for a critical RCE bug in Service Provider Console.

FULL LIST OF MICROSOFT PATCHES

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.