CVE-2025-24054

CVE-2025-24054 is a vulnerability involving external control of file name or path in Windows NTLM, enabling an unauthorized attacker to perform spoofing over a network. It affects the Windows NTLM authentication component and was published on 2025-03-11. The issue carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) and maps to CWE-73: External Control of File Name or Path.

An unauthorized attacker with network access can exploit this vulnerability by leveraging low-complexity techniques that require user interaction, such as clicking a malicious link or resource. Successful exploitation allows spoofing, resulting in high confidentiality impacts without affecting integrity or availability.

Microsoft's Security Response Center provides an update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054, which details remediation steps including patches. Additional references include a full disclosure on SecLists (http://seclists.org/fulldisclosure/2025/Apr/28), proof-of-concept exploits on Exploit-DB (https://www.exploit-db.com/exploits/52478 and https://www.exploit-db.com/exploits/52480), and a detection script from Vicarius (https://www.vicarius.io/vsociety/posts/cve-2025-24054-spoofing-vulnerability-in-windows-ntlm-by-microsoft-detection-script).

Publicly available exploits indicate potential for real-world abuse, underscoring the need for prompt patching on affected Windows systems using NTLM.