Cyber Posture

CVE-2025-24071

MediumPublic PoC

Published: 11 March 2025

Published
11 March 2025
Modified
03 July 2025
KEV Added
Patch
CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score 0.7352 98.8th percentile
Risk Priority 57 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.

Security Summary

CVE-2025-24071, published on 2025-03-11, is a vulnerability in Microsoft Windows File Explorer that exposes sensitive information to an unauthorized actor, enabling spoofing attacks over a network. Classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), indicating medium severity with high confidentiality impact.

An unauthorized attacker can exploit this vulnerability remotely over the network using low-complexity techniques that require no privileges, though user interaction is necessary. Exploitation allows the attacker to access sensitive information, supporting spoofing without impacting integrity or availability.

Microsoft's Security Response Center (MSRC) provides an update guide for mitigation at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24071. Vicarius has published related resources, including a detection script at https://www.vicarius.io/vsociety/posts/cve-2025-24071-spoofing-vulnerability-in-microsoft-windows-file-explorer-detection-scrip and a mitigation script at https://www.vicarius.io/vsociety/posts/cve-2025-24071-spoofing-vulnerability-in-microsoft-windows-file-explorer-mitigation-script.

Details

CWE(s)
CWE-200

Affected Products

microsoft
windows 10 1507
≤ 10.0.10240.20947 · ≤ 10.0.10240.20947
microsoft
windows 10 1607
≤ 10.0.14393.7876 · ≤ 10.0.14393.7876
microsoft
windows 10 1809
≤ 10.0.17763.7009 · ≤ 10.0.17763.7009
microsoft
windows 11 23h2
≤ 10.0.22631.5039
microsoft
windows 11 24h2
≤ 10.0.26100.3476 · ≤ 10.0.26100.3476
microsoft
windows server 2012
r2
microsoft
windows server 2016
≤ 10.0.14393.7876
microsoft
windows server 2019
≤ 10.0.17763.7009
microsoft
windows server 2022
≤ 10.0.20348.3328
microsoft
windows server 2022 23h2
≤ 10.0.25398.1486
+1 more product configuration(s) — see NVD for full list

MITRE ATT&CK Enterprise Techniques

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
Why these techniques?

The vulnerability in Windows File Explorer exposes sensitive information enabling spoofing attacks over the network, directly facilitating Adversary-in-the-Middle (T1557) by allowing an attacker to leverage the disclosed data for positioning in network communications.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References