May "In the Trend of VM" (#15): vulnerabilities in Microsoft Windows and the Erlang/OTP framework. A traditional monthly vulnerability roundup. 🙂
🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)
A total of 4 trending vulnerabilities:
🔻 Elevation of Privilege - Windows Common Log File System Driver (CVE-2025-29824)
🔻 Elevation of Privilege - Windows Process Activation (CVE-2025-21204)
🔻 Spoofing - Windows NTLM (CVE-2025-24054)
🔻 Remote Code Execution - Erlang/OTP (CVE-2025-32433)
About Remote Code Execution - 7-Zip (BDU:2025-01793) vulnerability. It's about the fact that files unpacked using 7-Zip don't get the Mark-of-the-Web. As a result, Windows security mechanisms don't block the execution of the unpacked malware. If you remember, there was a similar vulnerability in January - CVE-2025-0411. The problem was with running files from the 7-Zip UI, and a fix has been released. But in this case, the problem is with fully unpacked archives — and the developers aren't planning to fix it! 🤷♂️
Igor Pavlov, the author of the utility, responded to our colleague Konstantin Dymov that not assigning the Mark-of-the-Web by default is intentional behavior. They don't plan to change the default settings. To have the Mark-of-the-Web applied, you need to set "" to "".
If 7-Zip is used in your organization, be aware of this insecure default behavior. Apply hardening measures or switch to a different tool.
May Microsoft Patch Tuesday. A total of 93 vulnerabilities - about 1.5 times fewer than in April. Of these, 22 were added between the April and May MSPT. There are 5 vulnerabilities show signs of in-the-wild exploitation:
🔻 EoP - Microsoft DWM Core Library (CVE-2025-30400)
🔻 EoP - Windows CLFS Driver (CVE-2025-32701, CVE-2025-32706)
🔻 EoP - Windows Ancillary Function Driver for WinSock (CVE-2025-32709)
🔻 Memory Corruption - Scripting Engine (CVE-2025-30397). RCE when clicking a malicious link. Exploitation requires the "Allow sites to be reloaded in Internet Explorer" option.
There are currently no vulnerabilities with public exploits.
Notable among the rest:
🔹 RCE - Remote Desktop Client (CVE-2025-29966, CVE-2025-29967), Office (CVE-2025-30377, CVE-2025-30386), Graphics Component (CVE-2025-30388), Visual Studio (CVE-2025-32702)
🔹 EoP - Kernel Streaming (CVE-2025-24063), CLFS Driver (CVE-2025-30385)
About Elevation of Privilege - Windows Common Log File System Driver (CVE-2025-29824) vulnerability. The vulnerability from the April Microsoft Patch Tuesday allows an attacker operating under a regular user account to escalate their privileges to SYSTEM level.
🔻 According to Microsoft, the vulnerability was exploited in attacks against organizations in the U.S., Venezuela, Spain, and Saudi Arabia. The exploit was embedded in the PipeMagic malware used by the Storm-2460 group to deploy ransomware.
🔻 On May 7, Symantec reported technical details about another exploit for the vulnerability, used by Balloonfly group (associated with the Play ransomware) in an attack on a U.S. organization prior to April 8.
👾 Are there public exploits? According to BDU FSTEC — yes. NVD also lists "exploit links", but they point to detection and mitigation scripts. 🤷♂️ No mentions yet in exploit packs or on GitHub.
About Spoofing - Windows NTLM (CVE-2025-24054) vulnerability. It was patched in the March Microsoft Patch Tuesday. VM vendors didn't mention this vulnerability in their reviews; it was only known to be exploited via user interaction with a malicious file.
A month later, on April 16, Check Point published a blog post with technical details, revealing that the vulnerability is exploited using specially crafted files...
✋ Wait a minute — there was a trending vulnerability in March MSPT: CVE-2025-24071, related to the same files. 🤔 Turns out, it’s THE SAME vulnerability. 🤪 Check Point reports: "Microsoft had initially assigned the vulnerability the CVE identifier CVE-2025-24071, but it has since been updated to CVE-2025-24054". What a mess. 🤷♂️ Technical details in the previous post.
👾 Since March 19, Check Point has tracked about 11 campaigns exploiting this vulnerability to collect NTLMv2-SSP hashes.
About Elevation of Privilege - Windows Process Activation (CVE-2025-21204) vulnerability. This vulnerability from the April Microsoft Patch Tuesday was not highlighted by VM vendors in their reviews. It affects the Windows Update Stack component and is related to improper link resolution before file access (CWE-59).
🔻 On April 14, researcher Elli Shlomo (CYBERDOM) published a write-up and exploit code to gain SYSTEM privileges. On April 27, after reports that the exploit didn’t work, he removed it and promised to revise it. 🤔 Exploitability remains unclear.
🔻 On April 22, researcher Kevin Beaumont reported that the fix for this vulnerability, involving the creation of the folder, introduces a new denial-of-service vulnerability. It allows non-admin users to block the installation of Windows security updates. Microsoft responded that they don't plan to fix it promptly. 🤷♂️ For now, it’s recommended to monitor for malicious activity.
April "In the Trend of VM" (#14): vulnerabilities in Microsoft Windows, VMware products, Kubernetes, and Apache Tomcat. We decided to pause recording new videos, so for now only text. 🤷♂️🙂
🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)
A total of 11 trending vulnerabilities:
🔻 Elevation of Privilege - Windows Cloud Files Mini Filter Driver (CVE-2024-30085)
🔻 Spoofing - Windows File Explorer (CVE-2025-24071)
🔻 Four Windows vulnerabilities from March Microsoft Patch Tuesday were exploited in the wild (CVE-2025-24985, CVE-2025-24993, CVE-2025-26633, CVE-2025-24983)
🔻 Three VMware "ESXicape" Vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226)
🔻 Remote Code Execution - Apache Tomcat (CVE-2025-24813)
🔻 Remote Code Execution - Kubernetes (CVE-2025-1974)
This is my personal blog. The opinions expressed here are my own and not of my employer. All product names, logos, and brands are property of their respective owners. All company, product and service names used here for identification purposes only. Use of these names, logos, and brands does not imply endorsement. You can freely use materials of this site, but it would be nice if you place a link on https://avleonov.com and send message about it at me@avleonov.com or contact me any other way.