PT-2025-24857 · Microsoft · Windows Smb +1

James Forshaw + 2 · Published 2025-01-30 · Updated 2025-10-15 · CVE-2025-33073

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows versions prior to June 2025 Patch Tuesday

Description A critical vulnerability exists in the Windows SMB client that allows an attacker to elevate privileges to SYSTEM level. This is achieved through a reflective Kerberos relay attack, where authentication is coerced and relayed back to the attacker's system via SMB. The vulnerability bypasses previous NTLM reflection mitigations and is exploitable on systems without SMB signing enabled. A proof-of-concept exploit is publicly available. The vulnerability allows an authenticated attacker to gain remote command execution as SYSTEM. The issue involves manipulation of DNS records and can be exploited through local name resolution methods. The vulnerability has been exploited in the wild and is actively being discussed within the cybersecurity community. The estimated number of affected devices is over 2.7 million.

Recommendations Apply the June 2025 Patch Tuesday updates. Enforce SMB signing on all systems.

Exploit

Fix

RCE

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-06677

CVE-2025-33073

Affected Products

Windows

Windows Smb

References · 177

• 🔥 https://github.com/mverschu/CVE-2025-33073 · Exploit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33073 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-33073 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-33073 · Security Note
• https://bdu.fstec.ru/vul/2025-06677 · Security Note
• https://github.com/Pennyw0rth/NetExec · Note
• https://github.com/dirkjanm/krbrelayx · Note
• https://t.me/aptreports/19846 · Telegram Post
• https://t.me/ralfhackerchannel/1620 · Telegram Post
• https://twitter.com/CveTodo/status/1932746724185190540 · Twitter Post
• https://twitter.com/thalles/status/1932806150656782517 · Twitter Post
• https://twitter.com/decoder_it/status/1940086249420988572 · Twitter Post
• https://twitter.com/blueteamsec1/status/1944872818543657238 · Twitter Post
• https://t.me/echeloneyes/3911 · Telegram Post