CVE-2024-43451
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
Description
CVE-2024-43451 is a medium-severity NTLM Hash Disclosure Spoofing Vulnerability affecting a broad range of Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server editions from 2008 through 2025. Rated 6.5 on the CVSS v3.1 scale, this vulnerability enables a remote, unauthenticated attacker to capture NTLM authentication hashes from targeted users by luring them into interacting with a specially crafted file. With an EPSS score of 0.89928 (99.6th percentile), CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 3, 2024, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20826 |
| microsoft | windows 10 1607 | < 10.0.14393.7515 |
| microsoft | windows 10 1809 | < 10.0.17763.6532 |
| microsoft | windows 10 21h2 | < 10.0.19044.5131 |
| microsoft | windows 10 22h2 | < 10.0.19045.5131 |
| microsoft | windows 11 22h2 | < 10.0.22621.4460 |
| microsoft | windows 11 23h2 | < 10.0.22631.4460 |
| microsoft | windows 11 24h2 | < 10.0.26100.2314 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7515 |
| microsoft | windows server 2019 | < 10.0.17763.6532 |
| microsoft | windows server 2022 | < 10.0.20348.2849 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1251 |
| microsoft | windows server 2025 | < 10.0.26100.2314 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43451(US Government Resource)
Weakness Type
The specific CWE classification for CVE-2024-43451 has not been formally published by the vendor. However, the vulnerability is functionally related to improper handling of NTLM authentication challenge-response flows. When a user interacts with a malicious file — even through minimal actions such as right-clicking or previewing — Windows inadvertently initiates an NTLM authentication handshake that discloses the user's NTLMv2 hash to an attacker-controlled server. This class of weakness enables credential theft without requiring the user to open or execute the malicious file, making it a particularly stealthy attack vector.
Impact Analysis
Confidentiality is the primary impact area for CVE-2024-43451. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms that while no privileges are required from the attacker and the attack complexity is low, user interaction is needed. Once the NTLM hash is captured, the attacker can perform offline cracking to recover plaintext credentials or conduct pass-the-hash relay attacks against other systems on the network. Business impact extends well beyond a single compromised account — captured credentials may provide lateral movement opportunities across Active Directory environments, potentially granting access to file servers, email systems, and domain controllers. The EPSS score of 0.89928 places this vulnerability in the 99.6th percentile for exploitation probability, meaning it is more likely to be exploited than nearly all other known vulnerabilities. Organizations relying on NTLM authentication in their Windows environments face the highest risk, particularly those with flat network architectures that allow unrestricted lateral movement.
Exploit Maturity
CVE-2024-43451 has been confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 3, 2024. The ransomware association for this vulnerability is classified as "Unknown," meaning there is no confirmed link to ransomware campaigns at this time, though the credential-theft nature of this flaw makes it a natural precursor for ransomware deployment. The EPSS score of 0.89928 (99.6th percentile) reflects an extremely high probability of exploitation, consistent with the observed real-world attacks. The vulnerability's low attack complexity and the minimal user interaction required — merely previewing or right-clicking a malicious file — make it an attractive target for phishing campaigns and targeted attacks. Attackers can embed the exploit payload in document files, shortcuts, or other file types commonly distributed via email attachments or malicious websites.
Remediation
- Apply the Microsoft security update immediately — Install the patches referenced in the Microsoft Security Response Center advisory for all affected Windows versions, prioritizing internet-facing systems and user workstations.
- Restrict outbound NTLM traffic — Configure Windows Firewall and network security policies to block outbound SMB (port 445) and NTLM traffic to untrusted external networks, preventing hash relay to attacker-controlled servers.
- Enforce NTLMv2 and consider disabling NTLM — Set the LAN Manager authentication level to "Send NTLMv2 response only. Refuse LM & NTLM" through Group Policy, and evaluate migrating to Kerberos authentication where possible.
- Implement network segmentation — Limit lateral movement potential by segmenting the network so that compromised credentials on one subnet cannot be used to access critical resources on another.
- Enable credential protection mechanisms — Deploy Windows Credential Guard on supported editions to protect NTLM hashes stored in memory, and configure Extended Protection for Authentication (EPA) on critical services.
Technical Details
The CVSS v3.1 vector for CVE-2024-43451 is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, resulting in a base score of 6.5 (Medium). Attack Vector (Network) indicates the vulnerability is exploitable remotely without requiring local or adjacent network access. Attack Complexity (Low) confirms no specialized conditions are needed for exploitation. Privileges Required (None) means the attacker does not need any authenticated session on the target system. User Interaction (Required) is the sole mitigating factor — the victim must perform a minimal file interaction such as right-clicking, deleting, or moving a malicious file. Scope (Unchanged) means the vulnerability's impact remains within the security authority of the vulnerable component. Confidentiality (High) reflects the complete disclosure of the user's NTLMv2 hash, which represents a high-value credential. Integrity (None) and Availability (None) confirm no direct data modification or service disruption occurs. The attack mechanism exploits Windows' automatic NTLM authentication behavior, where certain file operations trigger an outbound authentication attempt to a UNC path or WebDAV resource embedded in the file metadata. The disclosed hash can then be cracked offline or relayed in real-time for authentication to other services that accept NTLM credentials.
Frequently Asked Questions
What is CVE-2024-43451?
CVE-2024-43451 is an NTLM Hash Disclosure Spoofing Vulnerability in Microsoft Windows. It allows a remote attacker to capture a user's NTLMv2 authentication hash when the victim interacts with a specially crafted file, even through minimal actions like right-clicking or previewing the file.
How severe is CVE-2024-43451?
With a CVSS score of 6.5 (Medium) and an EPSS score in the 99.6th percentile, this vulnerability represents a significant real-world risk despite its medium severity rating. The captured NTLM hash can be cracked offline or relayed to other systems, potentially leading to full network compromise.
Is CVE-2024-43451 being actively exploited?
Yes, CISA has confirmed active exploitation and added this vulnerability to its Known Exploited Vulnerabilities catalog. Federal agencies were required to remediate by December 3, 2024, and all organizations should treat patching as an urgent priority.
How do I protect against CVE-2024-43451?
Apply the latest Microsoft security updates for your Windows version immediately. Additionally, restrict outbound NTLM traffic, consider disabling NTLM authentication in favor of Kerberos, and deploy Windows Credential Guard to protect stored credentials.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.