PT-2025-24329 · Webdav+1 · Webdav+1
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows versions prior to June 2025
Description
An issue exists in the WebDAV module where external control of file names or paths in Internet Shortcut Files allows an unauthorized remote attacker to execute arbitrary code. The flaw enables a working-directory hijack using a crafted
.url shortcut to launch a legitimate signed Windows binary while pointing its working directory to an attacker-controlled WebDAV share. This technique can trick Windows into loading a malicious binary from the remote share instead of the legitimate one in System32, bypassing SmartScreen and Mark-of-the-Web security warnings. Real-world exploitation has been observed in phishing campaigns targeting users in Mexico via fake government ID-lookup sites to deliver infostealers.Recommendations
Apply the Microsoft security update released in June 2025.
Stop and set the WebClient service to Disabled on systems that do not require WebDAV.
Disable Basic Authentication by setting
UseBasicAuth to 0 and BasicAuthLevel to 0 in the registry settings.Exploit
Fix
RCE
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Webdav
Windows