The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Thursday added a medium-severity safety flaw impacting Microsoft Home windows to its Recognized Exploited Vulnerabilities (KEV) catalog, following stories of energetic exploitation within the wild.
The vulnerability, assigned the CVE identifier CVE-2025-24054 (CVSS rating: 6.5), is a Home windows New Know-how LAN Supervisor (NTLM) hash disclosure spoofing bug that was patched by Microsoft final month as a part of its Patch Tuesday updates.
NTLM is a legacy authentication protocol that Microsoft formally deprecated final 12 months in favor of Kerberos. Lately, risk actors have discovered numerous strategies to use the know-how, akin to pass-the-hash and relay assaults, to extract NTLM hashes for follow-on assaults.
“Microsoft Home windows NTLM comprises an exterior management of file title or path vulnerability that enables an unauthorized attacker to carry out spoofing over a community,” CISA mentioned.
In a bulletin revealed in March, Microsoft mentioned the vulnerability could possibly be triggered by minimal interplay with a specifically crafted .library-ms file, akin to “choosing (single-click), inspecting (right-click), or performing an motion aside from opening or executing the file.”
The tech large additionally credited Rintaro Koike with NTT Safety Holdings, 0x6rss, and j00sean for locating and reporting the flaw.
Whereas Microsoft has given CVE-2025-24054 an exploitability evaluation of “Exploitation Much less Probably,” the safety flaw has since come below energetic exploitation since March 19, per Examine Level, thereby permitting unhealthy actors to leak NTLM hashes or person passwords and infiltrate methods.
“Round March 20–21, 2025, a marketing campaign focused authorities and personal establishments in Poland and Romania,” the cybersecurity firm said. “Attackers used malspam to distribute a Dropbox hyperlink containing an archive that exploited a number of identified vulnerabilities, together with CVE-2025-24054, to reap NTLMv2-SSP hashes.”
The flaw is assessed to be a variant of CVE-2024-43451 (CVSS rating: 6.5), which was patched by Microsoft in November 2024 and has additionally been weaponized within the wild in assaults focusing on Ukraine and Colombia by risk actors like UAC-0194 and Blind Eagle.
In line with Examine Level, the file is distributed by the use of ZIP archives, inflicting Home windows Explorer to provoke an SMB authentication request to a distant server and leak the person’s NTLM hash with none person interplay merely upon downloading and extracting the archive’s contents.
That mentioned, one other phishing marketing campaign noticed as just lately as March 25, 2025, has been discovered delivering a file named “Data.doc.library-ms” with none compression. For the reason that first wave of assaults, at least 10 campaigns have been noticed with the top purpose of retrieving NTLM hashes from the focused victims.
“These assaults leveraged malicious .library-ms information to gather NTLMv2 hashes and escalate the chance of lateral motion and privilege escalation inside compromised networks,” Examine Level mentioned.
“This fast exploitation highlights the important want for organizations to use patches instantly and be certain that NTLM vulnerabilities are addressed of their environments. The minimal person interplay required for the exploit to set off and the benefit with which attackers can acquire entry to NTLM hashes make it a big risk, particularly when such hashes can be utilized in pass-the-hash assaults.”
Federal Civilian Government Department (FCEB) businesses are required to use the mandatory fixes for the shortcoming by Could 8, 2025, to safe their networks in mild of energetic exploitation.
Source link