PT-2025-15586 · Microsoft · Windows Kerberos+1

Ceri Coburn + 1 · Publicado 2025-04-08 · Atualizado 2025-07-10 · CVE-2025-29809

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Windows Kerberos (affected versions not specified)

Description The issue is related to insecure storage of sensitive information in Windows Kerberos, allowing an authorized attacker to bypass a security feature locally. This can potentially lead to the disclosure of protected information. The vulnerability is considered critical and has a low attack complexity, meaning it can be exploited by individuals with minimal system privileges. Although there have been no confirmed exploits reported in the wild, the likelihood of exploitation is classified as 'More Likely'.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Storage of Sensitive Information

Enumeração de Fraquezas

CWE-922

Identificadores relacionados

BDU:2025-04111

CVE-2025-29809

Produtos afetados

Windows

Windows Kerberos

Referências · 28

• https://twitter.com/CareWeDoNot/status/1910045180075389206 · Publicação no Twitter
• https://t.me/offensivetwitter/2922 · Publicação no Telegram
• https://reddit.com/r/CVEWatch/comments/1k2cptw/top_10_trending_cves_18042025 · Publicação no Reddit
• https://t.me/cvenotify/128360 · Publicação no Telegram
• https://twitter.com/windowsforum/status/1909661499687051431 · Publicação no Twitter
• https://t.me/purp_sec/523 · Publicação no Telegram
• https://netspi.com/blog/technical-blog/adversary-simulation/cve-2025-21299-cve-2025-29809-unguarding-microsoft-credential-guard · Nota
• https://reddit.com/r/CVEWatch/comments/1k262t8/top_10_trending_cves_18042025 · Publicação no Reddit
• https://t.me/avleonovcom/1524 · Publicação no Telegram
• https://t.me/msrcreports/1966 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-29809 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1909665138757484676 · Publicação no Twitter
• https://reddit.com/r/pwnhub/comments/1jv8356/critical_windows_kerberos_vulnerability_exposes · Publicação no Reddit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29809 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-29809 · Nota de Segurança