CVE-2025-24054
Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Description
CVE-2025-24054 is a medium-severity NTLM hash disclosure vulnerability in Microsoft Windows that allows an unauthorized attacker to perform spoofing attacks over the network. The flaw stems from external control of file name or path in the Windows NTLM authentication mechanism, enabling attackers to coerce NTLM authentication attempts and capture NTLMv2 hashes for offline cracking or relay attacks. With a CVSS v3.1 score of 6.5 (MEDIUM), the vulnerability requires user interaction but no authentication, affecting virtually all supported Windows versions from Windows 10 through Windows Server 2025. CISA has added CVE-2025-24054 to the Known Exploited Vulnerabilities catalog, and the EPSS score of 11.93% at the 93.61st percentile confirms active exploitation campaigns targeting Windows environments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20947 |
| microsoft | windows 10 1607 | < 10.0.14393.7876 |
| microsoft | windows 10 1809 | < 10.0.17763.7009 |
| microsoft | windows 10 21h2 | < 10.0.19044.5608 |
| microsoft | windows 10 22h2 | < 10.0.19045.5608 |
| microsoft | windows 11 22h2 | < 10.0.22621.5039 |
| microsoft | windows 11 23h2 | < 10.0.22631.5039 |
| microsoft | windows 11 24h2 | < 10.0.26100.3403 |
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7876 |
| microsoft | windows server 2019 | < 10.0.17763.7009 |
| microsoft | windows server 2022 | < 10.0.20348.3270 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1486 |
| microsoft | windows server 2025 | < 10.0.26100.3403 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054(Vendor Advisory)
- http://seclists.org/fulldisclosure/2025/Apr/28(Mailing List)
- https://www.exploit-db.com/exploits/52478(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/52480(Exploit, Third Party Advisory, VDB Entry)
- https://www.vicarius.io/vsociety/posts/cve-2025-24054-spoofing-vulnerability-in-windows-ntlm-by-microsoft-detection-script(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-24054-spoofing-vulnerability-in-windows-ntlm-by-microsoft-mitigation-script(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24054(US Government Resource)
Weakness Type
CWE-73: External Control of File Name or Path
CVE-2025-24054 is classified under CWE-73 (External Control of File Name or Path), which occurs when software allows user input to control or influence file names or paths used in filesystem operations. In the context of Windows NTLM, this weakness enables an attacker to craft specially named files or paths that trigger the operating system to initiate NTLM authentication to an attacker-controlled server, exposing the user's NTLM hash without their knowledge or explicit consent.
Learn more: CWE-73 — External Control of File Name or Path
Impact Analysis
CVE-2025-24054 has a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The vulnerability is remotely exploitable over the network (AV:N) with low complexity (AC:L) and requires no authentication (PR:N), but does require user interaction (UI:R) such as opening a folder containing a malicious file or clicking a link. Confidentiality (High): The primary impact is the disclosure of NTLM authentication hashes, which can be used in pass-the-hash attacks, NTLM relay attacks, or cracked offline to recover plaintext passwords. Captured credentials can grant access to email, file shares, internal applications, and potentially domain administrator privileges. Integrity and Availability are not directly impacted by the hash disclosure itself, but the captured credentials enable follow-on attacks that can compromise both. The breadth of affected products is enormous, spanning Windows 10 (all versions), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008 R2 through Windows Server 2025, making this vulnerability relevant to virtually every Windows enterprise environment. The EPSS score of 11.9% at the 93.6th percentile indicates a very high probability of exploitation.
Exploit Maturity
CVE-2025-24054 has very high exploit maturity with confirmed active exploitation in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 8, 2025. Public exploit code is available through multiple sources, including Exploit-DB (52478) and Exploit-DB (52480), as well as detection and mitigation scripts published on Vicarius vSociety. The EPSS score of 11.9% at the 93.6th percentile indicates a very high probability of exploitation. NTLM hash disclosure vulnerabilities are consistently popular among threat actors because they provide a stealthy way to harvest credentials for lateral movement within enterprise networks. The availability of multiple public exploits and the trivial nature of exploitation make immediate patching essential.
Remediation
-
Apply Microsoft security updates immediately. Install the patches from the Microsoft Security Response Center advisory for CVE-2025-24054 across all affected Windows versions. Priority should be given to domain controllers and servers with sensitive data.
-
Disable NTLM authentication where possible. Transition to Kerberos-based authentication and restrict NTLM usage through Group Policy settings. Configure "Network security: Restrict NTLM" policies to audit and then block NTLM traffic, especially outbound NTLM authentication to external servers.
-
Block outbound NTLM traffic at the network perimeter. Configure firewalls to block outbound SMB (TCP 445) and NTLM authentication traffic (TCP 139) to untrusted external destinations. This prevents NTLM hash leakage even if the vulnerability is triggered.
-
Deploy NTLM relay protections. Enable Extended Protection for Authentication (EPA) on all internal services. Implement SMB signing on all systems to prevent NTLM relay attacks using captured hashes.
-
Monitor for NTLM authentication anomalies. Configure security monitoring to detect unusual NTLM authentication attempts, particularly those directed to external IP addresses or unfamiliar servers. Alert on unexpected SMB connection attempts to non-standard destinations.
Technical Details
CVE-2025-24054 is an NTLM spoofing vulnerability caused by external control of file name or path in Windows NTLM. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a network-accessible attack with low complexity that requires user interaction but no authentication, resulting in high confidentiality impact.
The vulnerability exploits the way Windows handles certain file types and paths that trigger automatic NTLM authentication. When a user navigates to a folder containing a specially crafted file (such as a .url, .lnk, or similar shortcut file), Windows automatically attempts to resolve the embedded path, which can point to an attacker-controlled SMB server. This triggers an NTLM authentication handshake, sending the user's NTLMv2 hash to the attacker's server without any explicit action beyond browsing the folder. The captured hash can then be used in offline brute-force attacks to recover the plaintext password, or in NTLM relay attacks to authenticate to other services within the network. The vulnerability affects the entire range of supported Windows versions, from Windows 10 1507 through Windows Server 2025, indicating a fundamental flaw in the NTLM file path resolution mechanism.
Frequently Asked Questions
Is CVE-2025-24054 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2025-24054 to the Known Exploited Vulnerabilities catalog. Multiple public exploits are available on Exploit-DB, and the EPSS score of 11.93% at the 93.61st percentile confirms widespread exploitation activity.
What products are affected by CVE-2025-24054?
Virtually all supported Windows versions are affected, including Windows 10 (all versions), Windows 11 22H2/23H2/24H2, and Windows Server 2008 R2 through Windows Server 2025. This makes it relevant to nearly every Windows enterprise environment.
How do I fix CVE-2025-24054?
Apply the Microsoft security update from the MSRC advisory. Additionally, restrict outbound NTLM traffic at the network perimeter, disable NTLM where possible in favor of Kerberos, and enable Extended Protection for Authentication.
How severe is CVE-2025-24054?
With a CVSS v3.1 score of 6.5 (MEDIUM), the direct impact is NTLM hash disclosure. However, the captured credentials can enable severe follow-on attacks including lateral movement, privilege escalation, and full domain compromise, making the real-world impact much higher than the base score suggests.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.