CVE-2025-24054
Published: 11 March 2025
Summary
CVE-2025-24054 is a medium-severity External Control of File Name or Path (CWE-73) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Forced Authentication (T1187); ranked in the top 8.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses CVE-2025-24054 by requiring timely patching of the vulnerable Windows NTLM component as specified in Microsoft's update guide.
Prevents exploitation of CWE-73 external control of file name or path by validating all inputs to the NTLM authentication process.
Mitigates risk by establishing secure configuration settings to restrict or disable NTLM usage where possible, reducing attack surface for spoofing.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The external control of file name/path in NTLM directly enables forced authentication to an attacker-controlled server (T1187) and facilitates adversary-in-the-middle spoofing for credential capture/relay (T1557).
NVD Description
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
Deeper analysisAI
CVE-2025-24054 is a vulnerability involving external control of file name or path in Windows NTLM, enabling an unauthorized attacker to perform spoofing over a network. It affects the Windows NTLM authentication component and was published on 2025-03-11. The issue carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) and maps to CWE-73: External Control of File Name or Path.
An unauthorized attacker with network access can exploit this vulnerability by leveraging low-complexity techniques that require user interaction, such as clicking a malicious link or resource. Successful exploitation allows spoofing, resulting in high confidentiality impacts without affecting integrity or availability.
Microsoft's Security Response Center provides an update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054, which details remediation steps including patches. Additional references include a full disclosure on SecLists (http://seclists.org/fulldisclosure/2025/Apr/28), proof-of-concept exploits on Exploit-DB (https://www.exploit-db.com/exploits/52478 and https://www.exploit-db.com/exploits/52480), and a detection script from Vicarius (https://www.vicarius.io/vsociety/posts/cve-2025-24054-spoofing-vulnerability-in-windows-ntlm-by-microsoft-detection-script).
Publicly available exploits indicate potential for real-world abuse, underscoring the need for prompt patching on affected Windows systems using NTLM.
Details
- CWE(s)
- KEV Date Added
- 17 April 2025