Critical Windows Vulnerability CVE-2025-24054: Active Exploitation Steals NTLM Credentials

TL;DR

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a medium-severity vulnerability, CVE-2025-24054, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw allows attackers to steal NTLM credentials during file downloads on Microsoft Windows systems. Active exploitation has been reported, making immediate patching essential.

Introduction

On Thursday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) included a significant security vulnerability affecting Microsoft Windows in its Known Exploited Vulnerabilities (KEV) catalog. This medium-severity flaw, identified as CVE-2025-24054 with a CVSS score of 6.5, involves the disclosure of Windows New Technology LAN Manager (NTLM) hash credentials during file downloads. The vulnerability has been actively exploited in the wild, underscoring the urgency for system administrators to apply the necessary patches.

Understanding CVE-2025-24054

Vulnerability Details

• CVE Identifier: CVE-2025-24054
• CVSS Score: 6.5 (Medium)
• Affected Component: Windows New Technology LAN Manager (NTLM)
• Impact: Disclosure of NTLM hash credentials during file downloads

The vulnerability arises from a flaw in how Windows handles NTLM authentication during file download operations. Attackers can exploit this weakness to capture NTLM hashes, which can then be used to gain unauthorized access to user credentials. This poses a significant risk, particularly in enterprise environments where such credentials can be leveraged for further attacks.

Exploitation and Impact

Reports indicate that this vulnerability is being actively exploited in real-world scenarios. Attackers are targeting users by enticing them to download files, thereby initiating the NTLM authentication process and exposing the hash credentials. Once captured, these hashes can be cracked offline to reveal the plaintext passwords, allowing attackers to impersonate users and infiltrate networks.

Mitigation and Protection

Immediate Actions

To protect against this vulnerability, it is crucial to take the following steps:

1. Apply Security Patches: Ensure that all Windows systems are updated with the latest security patches provided by Microsoft.
2. Enable SMB Signing: Implement Server Message Block (SMB) signing to add an extra layer of security during file transfers.
3. Monitor Network Traffic: Use network monitoring tools to detect and respond to any suspicious file download activities.
4. User Education: Educate users about the risks associated with downloading files from untrusted sources and the importance of verifying file authenticity.

Long-Term Strategies

• Regular Patch Management: Establish a robust patch management process to ensure timely application of security updates.
• Network Segmentation: Implement network segmentation to limit the lateral movement of attackers within the network.
• Credential Management: Use strong, unique passwords and consider implementing multi-factor authentication (MFA) to enhance security.

Conclusion

The active exploitation of CVE-2025-24054 highlights the ongoing threat landscape faced by organizations relying on Microsoft Windows. By understanding the vulnerability and taking proactive measures to mitigate its impact, businesses can safeguard their systems and data from potential breaches. Regular updates, vigilant monitoring, and user education are key to maintaining a secure IT environment.

For more details, visit the full article: source

Additional Resources

For further insights, check:

• Microsoft Security Update Guide
• CISA Known Exploited Vulnerabilities Catalog