CVE-2025-21231
Published: 14 January 2025
Summary
CVE-2025-21231 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Service Exhaustion Flood (T1499.002); ranked in the top 19.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2025-21231 is a denial-of-service vulnerability in the IP Helper component of Windows, tracked under CWE-400. The flaw carries a CVSS 3.1 base score of 7.5 with a network attack vector, low attack complexity, and no required privileges or user interaction, resulting in high impact to availability while leaving confidentiality and integrity unaffected.
An unauthenticated remote attacker can exploit the issue by sending specially crafted network traffic to a vulnerable system, triggering resource exhaustion in the IP Helper service and causing it to stop responding. Successful exploitation produces a denial-of-service condition without requiring authentication or local access.
The official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21231 provides patch guidance and mitigation steps. EPSS for the CVE rose from a low baseline to a recorded peak of 0.0332 before settling at the current value of 0.0131, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2298
Vulnerability details
IP Helper Denial of Service Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of the IP Helper service for resource exhaustion DoS maps to Service Exhaustion Flood.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the vulnerability by applying Microsoft patches for the IP Helper DoS issue.
Denial-of-service protections at network entry points block or mitigate remote unauthenticated resource exhaustion attacks on IP Helper.
Resource availability controls enforce quotas and limits to counter the CWE-400 uncontrolled resource consumption in IP Helper.