PT-2025-26484 · Dnn · Dnn

Infosec-Au

·

Published

2025-06-20

·

Updated

2025-07-16

·

CVE-2025-52488

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: DNN (formerly DotNetNuke) versions 6.0.0 through 10.0.0
Description: The issue allows a specially crafted series of malicious interactions to potentially expose NTLM hashes to a third-party SMB server. This is a problem in the DNN.PLATFORM, part of the DNN content management system within the Microsoft ecosystem.
Recommendations: For versions 6.0.0 through 10.0.0, update to version 10.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the DNN.PLATFORM to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-52488
GHSA-MGFV-2362-JQ96

Affected Products

Dnn