The Fall Out from the Last Patch Tuesday (October) Continues USB

-

 


 What's the Problem?

  • USB keyboards and mice stop working in WinRE: After installing the update, USB input devices become unresponsive when booting into recovery mode. This means you can't navigate recovery options if your system fails to boot.
  • Normal operation is unaffected: USB devices still work fine within the standard Windows 11 environment.
  • Affected versions: Windows 11 24H2, 25H2, and Windows Server 2025.

Workarounds and Cautions

  • Avoid entering recovery mode unless absolutely necessary.
  • Legacy PS/2 devices still work in WinRE, if available.
  • Microsoft is working on a fix, but recovery patches KB5067039 and KB5067019 do not yet resolve the issue.

Broader USB Issues Post-Update

Some users also report:

  • USB ports failing to recognize devices after updates earlier this year.
  • Power flowing to ports but no data connectivity (e.g., camera lights up but doesn’t transmit data).
  • Attempts to roll back drivers or reset BIOS have had mixed results.

 Troubleshooting Tips

If you're facing USB issues outside of WinRE:

  • Reset USB controllers via Device Manager.
  • Update chipset and USB drivers from your device manufacturer.
  • Disable USB selective suspend in Power Options.
  • Inspect hardware for physical damage or debris.
  • Try alternate ports or cables to isolate the issue.

There are a few experimental work arounds. 

• DISM injection: Mount WinRE image and add USB drivers manually.

• Registry tweaks: Some claim modifying  settings helped restore functionality, but results vary.

• BIOS-level USB fallback: Enabling legacy USB support in BIOS may help in some recovery environments.

Popular posts from this blog

WSUS CVE-2025-59287 Mitigation

-
Image
CVE-2025-59287 is a critical Remote Code Execution (RCE) vulnerability affecting Windows Server Update Services (WSUS) . Here's a detailed breakdown of what it is, how it works, and what you should do about it: Overview Disclosed: October 2025 Patch Tuesday CVSS Score: 9.8 (Critical) Affected Systems: Windows Server 2012 through 2025 (including Server Core installations) Exploitability: Microsoft rates it as “Exploitation More Likely” Technical Details The vulnerability arises from unsafe deserialization of untrusted data in WSUS. Specifically, the GetCookie() endpoint in WSUS processes encrypted AuthorizationCookie objects without proper type validation. The deserialization occurs via .NET BinaryFormatter , which is known to be insecure when handling untrusted input. Attackers can send a crafted SOAP request to WSUS over port 8530 , containing a malicious AuthorizationCookie . The cookie is decrypted using a hardcoded AES key and then deserialized, allow...
Read more

Microsoft Defender for Endpoint (DFE) and Mitigation for It

-
Image
  The recent vulnerability affecting Microsoft Defender for Endpoint (DFE) involves critical flaws in how the agent communicates with its cloud backend, potentially allowing attackers to bypass authentication and manipulate incident response processes. Key Vulnerabilities in Defender for Endpoint (DFE) Authentication Bypass : Attackers can impersonate the Defender agent using only the machine ID and tenant ID, which are accessible to low-privileged users via registry reads. This allows them to spoof commands and responses. Command Interception : By querying endpoints like /edr/commands/cnc , attackers can intercept or fake responses (e.g., falsely reporting a device as isolated), undermining actual security status. Certificate Pinning Circumvention : Researchers bypassed HTTPS protections by patching memory functions (e.g., CRYPT32!CertVerifyCertificateChainPolicy ) to inspect traffic in plaintext using tools like Burp Suite and WinDbg. Azure Blob Upload Exploits : Attackers c...
Read more

Oracle has disclosed a critical vulnerability (CVE-2025-61882) (Patch Notes)

-
Image
  Oracle has disclosed a critical vulnerability (CVE-2025-61882) affecting E-Business Suite versions 12.2.3 through 12.2.14. This pre-authentication remote code execution (RCE) flaw enables unauthenticated attackers to exploit multiple chained weaknesses — including SSRF, CRLF injection, authentication bypass, and unsafe XSLT processing — to gain full control of affected systems. Risk Assessment: Severity: Critical (CVSS 9.8) Exposure: Internet-facing Oracle EBS instances are at immediate risk Threat Activity: Active exploitation confirmed by threat intelligence sources, including Cl0p ransomware group Business Impact: Potential compromise of financial systems, data exfiltration, and operational disruption Recommended Actions: Immediate Patch Deployment: Apply Oracle’s July 2025 Critical Patch Update to all affected EBS environments. Network Segmentation: Restrict public access to Oracle EBS systems. Ensure they are isolated from internet-facing zones. Threat Monito...
Read more