CVE-2025-21351
Published: 11 February 2025
Summary
CVE-2025-21351 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely installation of Microsoft patches for the Active Directory Domain Services API flaw.
Provides denial-of-service protections such as rate limiting and traffic anomaly detection to block exploitation of the API's uncontrolled resource consumption.
Protects system resources from depletion by monitoring usage and allocation to counter the CWE-400 resource exhaustion in the Domain Services API.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated network DoS via resource consumption in AD DS API, directly mapping to application/system exploitation for endpoint denial of service.
NVD Description
Windows Active Directory Domain Services API Denial of Service Vulnerability
Deeper analysisAI
CVE-2025-21351 is a Denial of Service vulnerability affecting the Windows Active Directory Domain Services API. Published on 2025-02-11, it is classified under CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS v3.1 base score of 7.5, reflecting high availability impact with no confidentiality or integrity effects.
The vulnerability can be exploited by unauthenticated attackers over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and without changing scope (S:U). Successful exploitation results in a high-impact denial of service (A:H), potentially disrupting Active Directory Domain Services availability.
Microsoft's update guide provides details on mitigation, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21351.
Details
- CWE(s)