CVE-2025-24054

What it actually does

This flaw allows an unauthenticated attacker to cause Windows to access an attacker-controlled network path and automatically perform NTLM authentication. When a user interacts with specially crafted content, Windows may send a NetNTLM challenge-response to the attacker’s SMB or WebDAV server. The attacker does not directly obtain the cleartext password, but can capture the NetNTLM hash for offline cracking or relay it to other NTLM-enabled services if relay protections are weak. The primary impact is credential exposure and spoofing over the network, with no direct code execution or availability impact by itself.

Why it matters to the business

Successful exploitation can expose employee or service account authentication material, enabling account takeover, lateral movement, access to file shares, email, VPNs, or other internal services that accept NTLM. Because this vulnerability is in the CISA Known Exploited Vulnerabilities catalog, has active exploitation reported in the wild, and has a CISA remediation deadline of 2025-05-08, it should be treated as an urgent remediation item. Systems or images that include the affected package should be updated promptly, including weaviate-fips-1.30 (MinimOS) to version 1.30.23-r0 or later.

How an attack unfolds

An attacker prepares a file, archive, shortcut-like object, document package, or other content containing a controlled external path such as a UNC, SMB, or WebDAV reference. The attacker delivers that content through phishing, file-sharing, web download, messaging, or another channel. When the victim previews, extracts, opens, or otherwise interacts with the content, Windows attempts to resolve the embedded path. That network access triggers NTLM authentication to the attacker-controlled server. The attacker captures the NetNTLM response and then either attempts to crack it offline to recover the password or relays it in real time to another service that accepts NTLM authentication and lacks strong protections such as SMB signing, Extended Protection for Authentication, or NTLM restrictions. Public reporting indicates active exploitation in NTLM relay and hash-leakage campaigns.

How to fix it

Apply the vendor fix for all affected Windows systems and rebuild or redeploy any images or containers that include vulnerable components. For the listed affected product, upgrade weaviate-fips-1.30 (MinimOS) to 1.30.23-r0 or later. As defense-in-depth, restrict or disable outbound SMB traffic to the internet, limit NTLM use where possible, enforce SMB signing, enable Extended Protection for Authentication on supported services, prefer Kerberos over NTLM, block WebDAV where not required, and harden email and web gateways against archive and shortcut-style credential-leak payloads. If immediate patching is not possible, prioritize egress filtering for TCP 445, TCP 139, UDP 137/138, and unnecessary WebDAV over HTTP/HTTPS to untrusted destinations.

How to confirm the fix worked

Confirm that all affected Windows assets have the relevant Microsoft security update installed and that packaged or image-based deployments have been rebuilt using fixed packages. For the listed package, verify the installed version is weaviate-fips-1.30 (MinimOS) 1.30.23-r0 or later. Validate network controls by attempting outbound SMB/WebDAV connectivity from representative workstations to an untrusted test destination and confirming it is blocked or monitored. Review endpoint and vulnerability management results to ensure the CVE no longer appears. Where NTLM reduction controls are implemented, verify that NTLM auditing shows expected declines and no critical services rely on unrestricted NTLM.

Typical attack path

1. Attacker creates malicious content containing an attacker-controlled external network path.
2. Attacker delivers the content to a target user through email, web download, chat, or file-sharing.
3. User previews, extracts, opens, or browses the crafted content.
4. Windows attempts to access the embedded SMB, UNC, or WebDAV path.
5. Windows automatically sends an NTLM challenge-response to the attacker-controlled server.
6. Attacker captures the NetNTLM material.
7. Attacker cracks the captured hash offline or relays it to an NTLM-enabled service.
8. Attacker uses the resulting access for account takeover, lateral movement, or further credential theft.

How to detect it

Look for evidence that endpoints initiated NTLM authentication to untrusted or internet-facing SMB or WebDAV servers after users opened or extracted files. Useful sources include Windows Security logs, Microsoft-Windows-NTLM/Operational logs, Microsoft-Windows-SMBClient logs, EDR file and process telemetry, proxy logs, firewall logs, DNS logs, and email gateway attachment telemetry. On endpoints, investigate Security Event ID 4624 with Logon Type 3 and Authentication Package NTLM where the destination or source pairing is unusual, NTLM Operational events showing outbound NTLM to non-corporate servers, and SMBClient events for failed or successful connections to unfamiliar hosts. At the network layer, hunt for outbound TCP 445, TCP 139, UDP 137/138, or WebDAV HTTP methods to unknown external IP addresses, especially where NTLMSSP or Authorization: NTLM appears. In file telemetry, look for recently delivered archives or files containing UNC paths, WebDAV URLs, .library-ms files, .url files, .lnk files, or document packages that reference external resources. If indicators are found, treat exposed accounts as potentially compromised and investigate for relay attempts, successful logons, password-spraying follow-on activity, and lateral movement.

• NTLMSSP
• Authorization: NTLM
• WWW-Authenticate: NTLM
• Authentication Package: NTLM
• Logon Type: 3
• Microsoft-Windows-NTLM/Operational
• Microsoft-Windows-SMBClient
• Event ID 8004
• Event ID 4624
• .library-ms
• .lnk
• .url
• file://
• \\
• WebDAV
• PROPFIND
• TCP/445
• TCP/139
• UDP/137
• UDP/138

What your security team should do

• Patch or upgrade affected systems immediately because this vulnerability is in the CISA Known Exploited Vulnerabilities catalog and exploitation is active in the wild.
• Upgrade weaviate-fips-1.30 (MinimOS) to 1.30.23-r0 or later wherever that package is present.
• Block outbound SMB and NetBIOS traffic to untrusted networks, especially TCP 445, TCP 139, UDP 137, and UDP 138.
• Audit and reduce NTLM usage; enforce SMB signing and Extended Protection for Authentication on services that still require NTLM.
• Hunt for recent outbound NTLM authentication attempts to unfamiliar external SMB or WebDAV endpoints.
• Inspect email, web proxy, EDR, and file telemetry for suspicious archives, shortcut-like files, library files, or documents containing external UNC paths.
• Prioritize users whose hashes may have been exposed for password reset, token/session review, and additional monitoring if exploitation indicators are found.
• Add detections for NTLM relay behavior, unusual WebDAV access, and outbound authentication to internet-hosted systems.