CVE-2025-21311 — Windows NTLMv1 Privilege Escalation

Key facts

CVE-2025-21311 is a Critical vulnerability: Windows NTLMv1 Privilege Escalation. This entry ships a detection-only PoC.

CVE	CVE-2025-21311
Severity	Critical
Detection / prevention	—
PoC	poc.py
Source	2025/CVE-2025-21311/

Details

Overview

Remote privilege escalation via NTLM

Vulnerability Details

• CVE ID: CVE-2025-21311
• CVSS Score: 9.8 (Critical)
• Type: Privilege Escalation
• Product: Windows NTLMv1

Affected Products

• Windows NTLMv1 (specific versions - check vendor advisory)

Proof of Concept

Usage

python3 poc.py -t https://target.com -c
python3 poc.py -t https://target.com -c --version-only

Mitigation

1. Apply vendor patches immediately
2. Implement network segmentation
3. Monitor for exploitation attempts
4. Review access controls

References

• NVD Entry

Disclaimer

This PoC is for authorized security testing only.

Frequently asked questions

What is CVE-2025-21311?

CVE-2025-21311 is a Critical vulnerability: Windows NTLMv1 Privilege Escalation. This entry ships a detection-only PoC.

How do I detect CVE-2025-21311?

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2025-21311?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

---

For authorized security testing and research only. See the full source and NVD record.