CVE-2025-21311
Published: 14 January 2025
Summary
CVE-2025-21311 is a critical-severity Incorrect Implementation of Authentication Algorithm (CWE-303) vulnerability in Microsoft Windows 11 24H2. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 12.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires identification, reporting, and correction of the specific NTLM V1 elevation of privilege flaw through timely application of Microsoft patches.
Enforces baseline configuration settings to disable or restrict legacy NTLM V1 authentication, directly preventing remote exploitation.
Limits the impact of successful NTLM V1 privilege escalation by ensuring components execute with minimal privileges necessary.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE is explicitly described as a remote elevation of privilege vulnerability in the Windows NTLM V1 authentication component with no privileges or user interaction required, directly mapping to exploitation of a software vulnerability for privilege escalation.
NVD Description
Windows NTLM V1 Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-21311 is a Windows NTLM V1 Elevation of Privilege Vulnerability, published on 2025-01-14. It affects the NTLM V1 authentication component in Windows systems, as indicated by the CWE-303 association and lack of additional CWE details from NVD.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. Remote attackers require only network access, with low attack complexity, no privileges, and no user interaction. Exploitation enables elevation of privilege, resulting in high impacts to confidentiality, integrity, and availability.
Microsoft's Security Response Center provides vulnerability update guidance, including patches and mitigations, at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21311.
Details
- CWE(s)