CVE‑2025‑24054: Windows NTLM Hash Disclosure Spoofing Vulnerability Allows Network‑Level Spoofing
What It Is – A newly disclosed flaw in Microsoft Windows NTLM authentication (CVE‑2025‑24054) lets an unauthenticated attacker manipulate file‑name/path parameters to disclose NTLM password hashes and spoof legitimate network identities.
Exploitability – Publicly disclosed; proof‑of‑concept code is available. The vulnerability is rated High (CVSS ≈ 7.8) and can be exploited over the network without prior access.
Affected Products – Microsoft Windows operating systems that implement NTLM (all supported client and server versions).
Why It Matters for Trust & Control Assurance
- Identity‑and‑Access controls – The flaw bypasses the integrity of credential verification, directly challenging the control objective of “ensure authentication mechanisms cannot be subverted.”
- Audit‑ready logging – Detecting NTLM hash leakage requires robust log collection and correlation; gaps here erode the evidentiary trail auditors demand.
- Continuous assurance – Enterprises must demonstrate that authentication controls are continuously monitored and that remediation (patches, configuration hardening) is verifiable.
Recommended Actions
- Apply Microsoft’s security update for CVE‑2025‑24054 immediately.
- Disable or restrict NTLM where possible; migrate to Kerberos or modern authentication protocols.
- Enforce multi‑factor authentication for privileged accounts to mitigate hash‑theft impact.
- Enable detailed authentication logging and integrate logs into a SIEM for real‑time detection of anomalous NTLM activity.
- Validate post‑patch posture through automated control‑mapping tools to capture evidence of remediation.
Source: CISA KEV – CVE‑2025‑24054