Microsoft Windows: External Control of File Name or Path in Windows NTLM (CVE-2025-24054) #shorts

Summary

In today's episode, we delve into a critical vulnerability in Microsoft Windows, labeled as CVE-2025-24054. This vulnerability, which targets the Windows NTLM authentication process, has been actively exploited since March 19, 2025. It's a medium-severity issue that has already impacted multiple organizations, particularly in Poland and Romania, and has been added to CISA’s Known Exploited Vulnerabilities catalog.

Product details

CVE-2025-24054 affects a wide range of Microsoft Windows products. This includes versions from Windows 10 1507 up to Windows 11 Version 24H2, as well as several iterations of the Windows Server, such as Windows Server 2008 R2 SP1 through Server 2025. The affected versions are primarily those with NTLM authentication enabled.

Vulnerability type summary

The vulnerability is categorized under CWE-73: External Control of File Name or Path. It allows unauthorized attackers to perform spoofing over a network through the manipulation of NTLM authentication processes. This external control flaw can lead to unauthorized access and data breaches.

Details of the vulnerability

Described as an external control of file name or path in Windows NTLM, this vulnerability empowers attackers to intercept and manipulate authentication data over a network, facilitating spoofing attacks. Since its publication on March 11, 2025, it has been actively exploited in the wild, posing significant network security threats. Attack campaigns exploiting this vulnerability have primarily targeted entities in Poland and Romania, highlighting the need for enhanced security measures and prompt patch updates.

Conclusion

CVE-2025-24054 is a stark reminder of the ever-present and evolving threats to network security. With active exploits in circulation, affected organizations should prioritize deploying the latest security updates from Microsoft to mitigate risks. Staying informed and proactive is key in navigating the complexities of cybersecurity in today's interconnected world.

Watch the full video on YouTube: CVE-2025-24054

Remediation and exploitation details

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

CVE database technical details

CVE ID

CVE-2025-24054

Description

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Provider

microsoft

CWE / problem types

CWE-73: External Control of File Name or Path

Affected Software Versions

Microsoft:Windows 10 Version 1809:[{'version': '10.0.17763.0', 'lessThan': '10.0.17763.7009', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2019:[{'version': '10.0.17763.0', 'lessThan': '10.0.17763.7009', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2019 (Server Core installation):[{'version': '10.0.17763.0', 'lessThan': '10.0.17763.7009', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2022:[{'version': '10.0.20348.0', 'lessThan': '10.0.20348.3328', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 10 Version 21H2:[{'version': '10.0.19044.0', 'lessThan': '10.0.19044.5608', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 11 version 22H2:[{'version': '10.0.22621.0', 'lessThan': '10.0.22621.5039', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 10 Version 22H2:[{'version': '10.0.19045.0', 'lessThan': '10.0.19045.5608', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2025 (Server Core installation):[{'version': '10.0.26100.0', 'lessThan': '10.0.26100.3476', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 11 version 22H3:[{'version': '10.0.22631.0', 'lessThan': '10.0.22631.5039', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 11 Version 23H2:[{'version': '10.0.22631.0', 'lessThan': '10.0.22631.5039', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2022, 23H2 Edition (Server Core installation):[{'version': '10.0.25398.0', 'lessThan': '10.0.25398.1486', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 11 Version 24H2:[{'version': '10.0.26100.0', 'lessThan': '10.0.26100.3476', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2025:[{'version': '10.0.26100.0', 'lessThan': '10.0.26100.3476', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 10 Version 1507:[{'version': '10.0.10240.0', 'lessThan': '10.0.10240.20947', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 10 Version 1607:[{'version': '10.0.14393.0', 'lessThan': '10.0.14393.7876', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2016:[{'version': '10.0.14393.0', 'lessThan': '10.0.14393.7876', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2016 (Server Core installation):[{'version': '10.0.14393.0', 'lessThan': '10.0.14393.7876', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2008 R2 Service Pack 1:[{'version': '6.1.7601.0', 'lessThan': '6.1.7601.27618', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2008 R2 Service Pack 1 (Server Core installation):[{'version': '6.1.7601.0', 'lessThan': '6.1.7601.27618', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2012:[{'version': '6.2.9200.0', 'lessThan': '6.2.9200.25368', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2012 (Server Core installation):[{'version': '6.2.9200.0', 'lessThan': '6.2.9200.25368', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2012 R2:[{'version': '6.3.9600.0', 'lessThan': '6.3.9600.22470', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2012 R2 (Server Core installation):[{'version': '6.3.9600.0', 'lessThan': '6.3.9600.22470', 'versionType': 'custom', 'status': 'affected'}]

Date Published

2025-03-11T16:59:09.963Z

Last Updated

2025-04-29T22:06:38.621Z