PT-2025-24857 · Microsoft · Windows Smb+1

James Forshaw + 2 · Published 2025-01-30 · Updated 2026-03-03 · CVE-2025-33073

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the June 2025 security updates

Description A critical improper access control issue exists in the Windows SMB client. This flaw allows an authenticated attacker to elevate privileges to the SYSTEM level on a network. The vulnerability stems from a weakness in Kerberos authentication relay, enabling attackers to coerce authentication and relay Kerberos tickets. Publicly available proof-of-concept exploits exist, and the vulnerability is being actively exploited in the wild. Attackers can exploit this issue by manipulating SMB messages, potentially gaining full control over compromised systems. The vulnerability is particularly severe on systems that do not enforce SMB signing.

Recommendations Apply the June 2025 security updates to all affected systems. Enforce SMB signing on all Windows systems.

Exploit

Fix

RCE

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-06677

CVE-2025-33073

Affected Products

Windows

Windows Smb

References · 244

• 🔥 https://github.com/mverschu/CVE-2025-33073 · Exploit
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-33073 · Security Note
• https://bdu.fstec.ru/vul/2025-06677 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-33073 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33073 · Vendor Advisory
• https://github.com/Pennyw0rth/NetExec · Note
• https://github.com/dirkjanm/krbrelayx · Note
• https://github.com/depthsecurity/RelayKing-Depth · Note
• https://twitter.com/RickSpairDX/status/1980556021815787774 · Twitter Post
• https://t.me/pentestbacklog/576 · Telegram Post
• https://twitter.com/DarkWebInformer/status/1978513046558351833 · Twitter Post
• https://twitter.com/badsectorlabs/status/1942579344284479671 · Twitter Post
• https://twitter.com/securityRSS/status/1932567204366623154 · Twitter Post
• https://twitter.com/Synacktiv/status/1933117315379257413 · Twitter Post