{"id":3113,"date":"2025-04-18T08:09:55","date_gmt":"2025-04-18T07:09:55","guid":{"rendered":"https:\/\/aegislens.com\/home\/?p=3113"},"modified":"2025-04-18T08:09:55","modified_gmt":"2025-04-18T07:09:55","slug":"understanding-cve-2025-24054-how-it-targets-and-steals-ntlm-credentials-during-file-download","status":"publish","type":"post","link":"https:\/\/aegislens.com\/home\/understanding-cve-2025-24054-how-it-targets-and-steals-ntlm-credentials-during-file-download\/","title":{"rendered":"Understanding CVE-2025-24054: How it Targets and Steals NTLM Credentials During File Download"},"content":{"rendered":"

issue that allows the attacker to steal network password hashes via the download of a seemingly innocent file.<\/p>\n

“`html<\/p>\n

Details about the Attack<\/h2>\n

The newly listed vulnerability resides in the handling of SMB traffic by Microsoft’s file sharing protocols.<\/p>\n

More specifically, an attacker can trick victims into accessing a malicious SMB server and steal the victims’ NTLM hash credentials the moment a file download is initiated.<\/p>\n

This attack plays out similarly to past incidents involving NTLM leaking, such as the SMBGhost flaw (CVE-2020-0796).<\/p>\n

However, CVE-2025-24054 takes advantage of a different attack vector that so far remained unexploited.<\/p>\n

Real-World Implications<\/h2>\n

By disseminating seemingly benign files carrying the exploit\u2014as email attachments, for example\u2014attackers could gain unauthorized access to architecture supporting critical information infrastructures.<\/p>\n

Such breaches have devastating consequences.<\/p>\n

Any disruption to these systems poses a risk to national security, public health and safety, economic vitality, and way of life.<\/p>\n

Best Practices for Mitigation<\/h2>\n

Despite the active exploitation, there are preventive actions that security professionals can undertake:<\/p>\n