CVE-2025-61303
CRITICALHatching Triage Sandbox Windows 10 build 2004 and LTSC 2021 - Denial-of-Analysis via Recursive Child Process Spawning
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-61303. PoCs published by adminlove520, eGkritsis.
AI-analyzed exploit summary The repository contains a scanner for CVE-2024-21762, which checks for the presence of the vulnerability in Fortinet SSL VPN interfaces. It includes Python scripts that send crafted HTTP requests to detect if a target is vulnerable.
Description
Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerability in its Windows behavioral analysis engine that allows a submitted malware sample to evade detection and cause denial-of-analysis. The vulnerability is triggered when a sample recursively spawns a large number of child processes, generating high log volume and exhausting system resources. As a result, key malicious behavior, including PowerShell execution and reverse shell activity, may not be recorded or reported, misleading analysts and compromising the integrity and availability of sandboxed analysis results.
Exploits (2)
The repository contains a scanner for CVE-2024-21762, which checks for the presence of the vulnerability in Fortinet SSL VPN interfaces. It includes Python scripts that send crafted HTTP requests to detect if a target is vulnerable.
This PoC demonstrates a denial-of-analysis vulnerability in RecordedFuture Triage's Windows behavioral analysis engine by recursively spawning child processes to exhaust system resources, leading to incomplete or missing telemetry. The exploit culminates in a PowerShell reverse-shell stage, which is not recorded in vulnerable configurations.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H