PT-2025-24857 · Microsoft · Windows Smb+1

James Forshaw + 2 · Published 2025-01-30 · Updated 2026-04-27 · CVE-2025-33073

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows versions prior to June 2025 Patch Tuesday

Description A critical vulnerability exists in the Windows SMB client, identified as CVE-2025-33073, allowing for potential privilege escalation to SYSTEM level. This flaw stems from improper access control and enables attackers to exploit the vulnerability through a reflective Kerberos relay attack. Attackers can coerce authentication and relay Kerberos tickets to gain unauthorized access. Publicly available proof-of-concept exploits exist, and active exploitation has been observed. The vulnerability affects Windows Server, Windows 10, and Windows 11. The vulnerability allows an authenticated attacker to gain SYSTEM level access. The flaw is exploitable through SMB, LDAP, and RPC protocols. Several proof-of-concept exploits are available.

Recommendations Apply the June 2025 Patch Tuesday updates. Enforce SMB signing. Restrict outgoing SMB traffic.

Exploit

Fix

RCE

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-06677

CVE-2025-33073

Affected Products

Windows

Windows Smb

References · 252

• 🔥 https://github.com/mverschu/CVE-2025-33073 · Exploit
• 🔥 https://exploit-db.com/exploits/52330 · Exploit
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-33073 · Security Note
• https://bdu.fstec.ru/vul/2025-06677 · Security Note
• https://osv.dev/vulnerability/CVE-2025-33073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-33073 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33073 · Vendor Advisory
• https://github.com/Pennyw0rth/NetExec · Note
• https://github.com/dirkjanm/krbrelayx · Note
• https://github.com/depthsecurity/RelayKing-Depth · Note
• https://twitter.com/windowsforum/status/1942649670758506856 · Twitter Post
• https://twitter.com/Secwiserapp/status/1980531324030214299 · Twitter Post
• https://t.me/purp_sec/761 · Telegram Post
• https://synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 · Note