PT-2025-24857 · Microsoft · Windows Smb+1

James Forshaw + 2 · CVE-2025-33073 · Published 2025-01-30 · Updated 2026-07-17

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows (affected versions not specified)

Description Improper access control in the Windows SMB client, specifically within the mrxsmb.sys driver, allows an authorized or unauthenticated remote attacker to elevate privileges to the NT AUTHORITYSYSTEM level. The issue stems from weaknesses in authentication relaying, including NTLM reflection and Reflective Kerberos Relay attacks. Attackers can use authentication coercion techniques, such as forcing a request to a UNC path, to intercept authentication tickets. By manipulating CREDENTIAL TARGET INFORMATIONW and forcing Kerberos usage over NTLM via SPNEGO, an attacker can relay a computer account ticket (DOMAINMACHINE$) back to the host to gain full system control. This exploitation can occur over standard RPC and SMB services and may bypass SMB signing to relay authentication across protocols such as LDAP, LDAPS, and RPC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

RCE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-06677

CVE-2025-33073

OPENSUSE-SU-2026:10837-1

Affected Products

Windows

Windows Smb

References · 280

• 🔥 https://github.com/mverschu/CVE-2025-33073 · Exploit
• 🔥 https://exploit-db.com/exploits/52330 · Exploit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33073 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10837-1 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06677 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-33073 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-33073 · Security Note
• https://osv.dev/vulnerability/CVE-2025-33073 · Vendor Advisory
• https://github.com/Pennyw0rth/NetExec · Note
• https://github.com/dirkjanm/krbrelayx · Note
• https://github.com/depthsecurity/RelayKing-Depth · Note
• https://github.com/F5Networks/terraform-azure-bigip-module · Note
• https://t.me/rnetsec/21652 · Telegram Post
• https://t.me/proxy_bar/2876 · Telegram Post