CVE-2025-24071
Published: 11 March 2025
Summary
CVE-2025-24071 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked in the top 1.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely application of Microsoft patches to Windows File Explorer as specified in the MSRC update guide.
Monitors systems specifically for unauthorized disclosure of sensitive information, which is the primary exploitation vector in this CVE.
Scans for and identifies vulnerabilities like CVE-2025-24071 in Windows File Explorer to enable proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in Windows File Explorer exposes sensitive information enabling spoofing attacks over the network, directly facilitating Adversary-in-the-Middle (T1557) by allowing an attacker to leverage the disclosed data for positioning in network communications.
NVD Description
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
Deeper analysisAI
CVE-2025-24071, published on 2025-03-11, is a vulnerability in Microsoft Windows File Explorer that exposes sensitive information to an unauthorized actor, enabling spoofing attacks over a network. Classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), indicating medium severity with high confidentiality impact.
An unauthorized attacker can exploit this vulnerability remotely over the network using low-complexity techniques that require no privileges, though user interaction is necessary. Exploitation allows the attacker to access sensitive information, supporting spoofing without impacting integrity or availability.
Microsoft's Security Response Center (MSRC) provides an update guide for mitigation at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24071. Vicarius has published related resources, including a detection script at https://www.vicarius.io/vsociety/posts/cve-2025-24071-spoofing-vulnerability-in-microsoft-windows-file-explorer-detection-scrip and a mitigation script at https://www.vicarius.io/vsociety/posts/cve-2025-24071-spoofing-vulnerability-in-microsoft-windows-file-explorer-mitigation-script.
Details
- CWE(s)