cymulate.com
https://cymulate.com/blog/ntlm-leak-cve-2025-59214 CVE-2025-59214
MEDIUM
Microsoft Windows File Explorer Spoofing Vulnerability
Record summary
CVE-2025-59214 has a selected CVSS score of 6.5 (medium); EIP currently links 1 repository PoC.
Description
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
Description source: GitHub Advisory
Exploitation context
Available material
- Repository PoCs
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 14, 2025 · Source: CVE List
Affected products and versions
Showing 12 of 26| Product | Source | Version range | Status |
|---|---|---|---|
Windows 10 Version 1507Browse Microsoft / Windows 10 Version 1507 | CVE List | 10.0.10240.0 to < 10.0.10240.21161 | affected |
Windows 10 Version 1607Browse Microsoft / Windows 10 Version 1607 | CVE List | 10.0.14393.0 to < 10.0.14393.8519 | affected |
Windows 10 Version 1809Browse Microsoft / Windows 10 Version 1809 | CVE List | 10.0.17763.0 to < 10.0.17763.7919 | affected |
Windows 10 Version 21H2Browse Microsoft / Windows 10 Version 21H2 | CVE List | 10.0.19044.0 to < 10.0.19044.6456 | affected |
Windows 10 Version 22H2Browse Microsoft / Windows 10 Version 22H2 | CVE List | 10.0.19045.0 to < 10.0.19045.6456 | affected |
Windows 11 Version 23H2Browse Microsoft / Windows 11 Version 23H2 | CVE List | 10.0.22631.0 to < 10.0.22631.6060 | affected |
Windows 11 Version 24H2Browse Microsoft / Windows 11 Version 24H2 | CVE List | 10.0.26100.0 to < 10.0.26100.6899 | affected |
Windows 11 Version 25H2Browse Microsoft / Windows 11 Version 25H2 | CVE List | 10.0.26200.0 to < 10.0.26200.6899 | affected |
Windows 11 version 22H2Browse Microsoft / Windows 11 version 22H2 | CVE List | 10.0.22621.0 to < 10.0.22621.6060 | affected |
Windows 11 version 22H3Browse Microsoft / Windows 11 version 22H3 | CVE List | 10.0.22631.0 to < 10.0.22631.6060 | affected |
Windows Server 2008 R2 Service Pack 1Browse Microsoft / Windows Server 2008 R2 Service Pack 1 | CVE List | 6.1.7601.0 to < 6.1.7601.27974 | affected |
Windows Server 2008 R2 Service Pack 1 (Server Core installation)Browse Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation) | CVE List | 6.1.7601.0 to < 6.1.7601.27974 | affected |
Proofs of concept
1Repository PoCs
GitHubrubenformation/CVE-2025-50154Repository PoCby rubenformationStars: 55Exploit3 files
Analysis
Technical assessment
A PowerShell script (poc.ps1) that crafts a malicious .LNK shortcut file. When the shortcut is placed on a victim's Windows system, File Explorer automatically attempts to fetch a remote PE file over SMB to extract its icon, triggering an NTLMv2-SSP hash disclosure to an attacker-controlled server without user interaction.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept (PoC) for CVE-2025-50154 and CVE-2025-59214, which are NTLM hash disclosure vulnerabilities in Windows File Explorer. The PoC consists of a README.md documentation file and a poc.ps1 PowerShell script. The script creates a .LNK shortcut file that points to a remote SMB server, causing Explorer to attempt to fetch an icon and leak NTLM credentials. The script performs only the described PoC behavior: it constructs a shortcut with user-supplied parameters and saves it to disk. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed. The code is transparent, well-documented, and contains no obfuscation, persistence mechanisms, credential exfiltration to unrelated parties, or concealed harmful behavior.
ClassificationExploit
Model confidence95%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact includes a functional PowerShell script (poc.ps1) that generates a malicious .LNK file designed to trigger an NTLMv2 hash disclosure vulnerability in Windows File Explorer. The README explicitly describes this as a 'Zero Click NTLMv2-SSP Hash Disclosure' and provides step-by-step instructions for setting up an attacker SMB server and deploying the crafted shortcut to a victim. This constitutes code intended to exercise a vulnerability, which meets the definition of an exploit.
README.md:3README.md:14poc.ps1:1-46Requirements
- An attacker-controlled SMB server (e.g., impacket-smbserver) hosting a PE binary file.
README.md:35-36 - Ability to deliver the crafted .LNK file to the victim's filesystem (e.g., via malicious download or SMB upload).
README.md:39
Observed behavior
- Creates a .LNK shortcut file with a target path pointing to a remote SMB-hosted binary and an icon location set to a local shell32.dll.
poc.ps1:34-43 - When the .LNK file is rendered by explorer.exe, the process fetches the remote PE file to extract its icon resources, causing the victim to authenticate to the attacker's SMB server and disclose NTLMv2-SSP hashes.
README.md:25README.md:46
Behaviors behind the backdoor verdict
Observables
- Network Target
- \\$ip\$share\$fileThe LNK file's TargetPath is set to a user-supplied remote SMB path, which is the core of the NTLM hash disclosure technique.
poc.ps1:35poc.ps1:41 - File Creation
- poc.lnkThe script creates a .LNK file on the local filesystem at the user-specified path.
poc.ps1:34poc.ps1:40-43
What the analysis did not establish
- One file (total 3) is omitted from the packet; its content is not provided, but the README and PoC script are complete.
- The evidence does not include the actual PE binary file to be hosted on the SMB server.
- The analysis is based solely on the supplied text; the code was not executed, and its effectiveness is not verified.
- One file (Taskmgr.exe, 1497 bytes) was classified as binary and was not inspected for content; it is a standard Windows executable used as an example icon source and is not executed by the PoC.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
References
6github.com
https://github.com/rubenformation/CVE-2025-50154 Microsoft Windows File Explorer Spoofing VulnerabilityVendor advisorypatch
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59214 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-59214 vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-59214-detection-script-windows-file-explorer-spoofing-vulnerability vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-59214-mitigation-script-windows-file-explorer-spoofing-vulnerability