CVE-2025-24054

Published Mar 11, 2025

Last updated a month ago

Exploit known CVSS medium 6.5

Windows NTLM

Smb

Overview

Description: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_21h2, windows_10_22h2, windows_11_22h2, windows_11_23h2, windows_11_24h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, windows_server_2025

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.4
Impact score: 2.5
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Exploit added on: Apr 17, 2025
Exploit action due: May 8, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-73

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "6997DE6E-CBAD-4690-A68C-8F10E477DCC2",
            "versionEndExcluding": "10.0.10240.20947",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "3CBCF6D9-5085-473C-82F5-98BC246A9C4C",
            "versionEndExcluding": "10.0.10240.20947",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "0CF0E174-4692-4AA3-B72E-12E73A1BDBE5",
            "versionEndExcluding": "10.0.14393.7876",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "340EF5F8-D4F5-4AD8-9D80-1DEC2F376BE5",
            "versionEndExcluding": "10.0.14393.7876",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "67C8DCD7-90C4-431F-BD03-FDFDE170E748",
            "versionEndExcluding": "10.0.17763.7009",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "05169574-28AB-4E42-B3DE-710574BB1AD3",
            "versionEndExcluding": "10.0.17763.7009",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "714C0D5E-BE31-45AB-A729-FF55DE59F593",
            "versionEndExcluding": "10.0.19044.5608",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "0C8B2D45-7059-4FA0-A46C-64A171D287DA",
            "versionEndExcluding": "10.0.19044.5608",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "5569800D-B907-47CC-86D2-EC0118157916",
            "versionEndExcluding": "10.0.19044.5608",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "A84E706C-3A65-4920-8F80-2A684D3CB110",
            "versionEndExcluding": "10.0.19045.5608",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "ED157557-37C1-4802-8746-B87120BA16FA",
            "versionEndExcluding": "10.0.19045.5608",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "BE8F0EF2-EED3-4791-AE26-D24D97B673D6",
            "versionEndExcluding": "10.0.19045.5608",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "C8949B3E-5847-42F8-A15A-D7515F0EE305",
            "versionEndExcluding": "10.0.22621.5039",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "84D4F97D-3BA2-4B7A-B650-5772DE49CE97",
            "versionEndExcluding": "10.0.22621.5039",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "82807292-1736-4453-B805-3D471BF94A35",
            "versionEndExcluding": "10.0.22631.5039",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "E19130AD-ECD6-4FC4-B2C8-AB058BDEF928",
            "versionEndExcluding": "10.0.22631.5039",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "B7ADF37E-1DD3-4539-8922-1E059955FEF1",
            "versionEndExcluding": "10.0.26100.3403",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "E0A74D52-ABC0-4733-B892-F8688B6AEBA7",
            "versionEndExcluding": "10.0.26100.3403",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
            "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
            "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C7610CDB-A02B-4C62-B17F-6DCE2B3DE4F0",
            "versionEndExcluding": "10.0.14393.7876",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D271422D-A29F-4DBF-BF72-BCD90E393A5A",
            "versionEndExcluding": "10.0.17763.7009",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "AAACC9C4-DDC5-4059-AFE3-A49DB2347A86",
            "versionEndExcluding": "10.0.20348.3270",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EF423F8C-2E8A-46AB-BB2D-C416BF341F92",
            "versionEndExcluding": "10.0.25398.1486",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CF81B44C-8FF7-4C61-9974-3F98DA9D492C",
            "versionEndExcluding": "10.0.26100.3403",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References