CVE-2025-1868

MEDIUM

Information display on multiple products from Famatech Corp

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-1868 has a selected CVSS score of 6.9 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

Vulnerability of unauthorized exposure of confidential information affecting Advanced IP Scanner and Advanced Port Scanner. It occurs when these applications initiate a network scan, inadvertently sending the NTLM hash of the user performing the scan. This vulnerability can be exploited by intercepting network traffic to a legitimate server or by setting up a fake server, in both local and remote scenarios. This exposure is relevant for both HTTP/HTTPS and SMB protocols.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 3, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Advanced IP Scanner

Browse Famatech Corp / Advanced IP Scanner

Default status: unaffected

CVE List2.5.4594.1 and earlierunaffected

Advanced Port Scanner

Browse Famatech Corp / Advanced Port Scanner

Default status: unaffected

CVE List2.5.3869 and earlierunaffected

Proofs of concept

1

Repository PoCs

GitHubitres-labs/CVE-2025-1868Repository PoCby itres-labs2Scanner9 files

10.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Dockerized PHP application that acts as an HTTP listener to detect NTLM credential leakage from Advanced IP/Port Scanner. It triggers an NTLM handshake and logs the domain, user, and workstation from NTLM Type 3 messages without exploiting the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (Dockerfile, README.md, run.sh) implement a simple PHP-based NTLM handshake tester for CVE-2025-1868. No backdoor, deceptive payload, or concealed harmful behavior is present. The code sets up a logging endpoint, does not execute hidden commands, and does not exfiltrate data beyond the stated purpose.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPHPShellDockerfile
Target softwareAdvanced IP ScannerAdvanced Port Scanner
Attack typesCredential Leakage Detection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a passive listener that detects and logs NTLM credential leakage; it does not actively exploit the vulnerability to gain unauthorized access or execute code. The README explicitly states it 'does not validate passwords' and 'only logs claimed identity and request metadata', which is consistent with a scanner/detector.

README.md:1-9

Requirements

  • A vulnerable instance of Advanced IP Scanner or Advanced Port Scanner must initiate a network scan that sends NTLM hashes to the listener.README.md:1
  • The listener must be reachable on port 80 by the scanning host.README.md:11

Observed behavior

  • Starts an Apache web server with PHP that listens on port 80.Dockerfile:1-18run.sh:36-41
  • Receives HTTP requests and triggers an NTLM handshake by responding with a 401 Unauthorized and WWW-Authenticate: NTLM header.README.md:3
  • Parses NTLM Type 3 messages to extract and log the claimed domain, user, and workstation.README.md:3
  • Logs extracted identity information and request metadata to a file.README.md:7
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Log File Creation
Payload withheldThe application logs NTLM identity claims and request metadata to this file, consistent with the stated diagnostic purpose.Dockerfile:16README.md:3-7
Port Binding
Payload withheldThe README and run.sh require port 80 for the HTTP listener, which is necessary for the NTLM handshake interception scenario described in the CVE.README.md:11run.sh:22-24
Privilege Escalation
Payload withheldrun.sh uses sudo to bind to port 80 when not running as root. This is a standard requirement for low port binding and does not indicate malicious intent.run.sh:36-38
Review boundaries

What the analysis did not establish

  • The evidence does not include the PHP source code (src/index.php), which is the core logic for NTLM handshake and parsing. Only Dockerfile, README, and run.sh are provided.
  • The artifact's behavior is inferred from documentation; the actual implementation of NTLM message parsing is not visible in the supplied files.
  • The main PHP application file (src/index.php) is not included in the supplied evidence; only Dockerfile, README.md, and run.sh were reviewed.
  • Six additional text files in the repository were omitted from the evidence packet and were not reviewed.
  • No binary files were identified, so binary analysis was not performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

compose.yml

itres-labs/CVE-2025-1868Created Vuln labCVE-2025-1868Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized PHP application that acts as an NTLM HTTP endpoint to trigger NTLM handshakes and log claimed identity from Type 3 messages, designed to test NTLM credential leakage from scanners.

README.md:1-3src/index.php:3-7

Lab assessment

Vulnerability lab

The README explicitly states the purpose is to confirm NTLM leakage related to CVE-2025-1868, and the PHP code implements an NTLM handshake endpoint for testing.

README.md:1-3src/index.php:3-7
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

ntlm-http-tester

NTLM HTTP endpointLogging service

A PHP 8.2 Apache service that implements an NTLM handshake, extracts domain/user/workstation from Type 3 messages, and logs the data to a file.

compose.yml:2-3Dockerfile:1src/index.php:1-250
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-1868

Supported by supplied evidence

The README and PHP code reference CVE-2025-1868 and implement a helper to validate NTLM leakage, consistent with the CVE's description of credential exposure.

README.md:1-3src/index.php:3-7
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed.run.sh:5-7
  • Host port 80 must be available.run.sh:19-27
  • The service must be reachable by a scanner or client that initiates NTLM authentication.README.md:3

Evidence-described exercise path

  1. Run ./run.sh to build and start the Docker container on port 80.run.sh:1-45
  2. Trigger an NTLM handshake by accessing the endpoint from a scanner or client that sends NTLM credentials.README.md:3
  3. Check the log file at data/scan.log for captured domain, user, and workstation information.README.md:12-14
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The application only logs NTLM identity data to a bind-mounted file and does not perform any host escape, external communication, persistence, or destructive actions. Port mapping and volume mount are necessary for the lab's function.

src/index.php:1-250compose.yml:1-9
Review boundaries

What the analysis did not establish

  • The packet does not include a runnable scanner or client to trigger the NTLM handshake; the exercise path relies on external tools.
  • The CVE-2025-1868 record details are not included in the packet, so the exact vulnerability mechanism is not independently verified.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

1