CVE-2025-21218
Published: 14 January 2025
Summary
CVE-2025-21218 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 19.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2025-21218 is a denial-of-service vulnerability in the Windows Kerberos implementation, tracked under CWE-400. It affects the Kerberos authentication component in Windows and is rated 7.5 CVSS:3.1 with a vector that reflects network attackability, low complexity, and no required privileges or user interaction, resulting in high availability impact while leaving confidentiality and integrity untouched.
An unauthenticated remote attacker can send crafted traffic to trigger uncontrolled resource consumption in the Kerberos service, causing a denial-of-service condition that disrupts authentication for affected systems. No prior access or credentials are needed, allowing the flaw to be reached directly over the network.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21218 supplies patch information and mitigation guidance. EPSS probability has climbed from a low baseline to a recorded peak of 0.0332, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2287
Vulnerability details
Windows Kerberos Denial of Service Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of the Kerberos component causes application/system crash and DoS (availability impact).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely flaw remediation, directly addressing CVE-2025-21218 by requiring patches for the Windows Kerberos DoS vulnerability.
SC-5 provides denial-of-service protection mechanisms such as rate limiting to mitigate remote unauthenticated exploitation causing resource exhaustion in Kerberos.
SC-6 ensures resource availability by protecting against uncontrolled consumption attacks like CWE-400 in the Windows Kerberos component.