{"id":"CVE-2024-43451","published":"2024-11-12T18:15:22Z","modified":"2026-06-17T07:51:04Z","title":"Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"NTLM Hash Disclosure Spoofing Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"A spoofing flaw in Microsoft Windows allows disclosure of NTLMv2 hashes, stemming from external control of a file name or path in an NTLM-related component. An attacker can exploit it remotely over the network without authentication, but it requires the victim to interact with the crafted resource, such as by opening or viewing it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:33Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.84266,"percentile":0.99696,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-11-12","dueDate":"2024-12-03","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43451","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-11-12","exploitedFirstSeen":"2024-11-12","ransomware":true,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Nov","date":"2024-11-12"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451","date":"2024-11-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-11-12"},{"url":"https://www.clearskysec.com/0d-vulnerability-exploited-in-the_wild/","date":"2024-11-13"},{"url":"https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf","date":"2025-02-21"},{"url":"https://www.cert.europa.eu/publications/threat-intelligence/tlr2024/pdf","date":"2025-02-25"},{"url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/","date":"2025-03-10"},{"url":"https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/","date":"2025-04-16"},{"url":"https://nsfocusglobal.com/nsfocus-apt-briefing-march-2025/","date":"2025-04-27"},{"url":"https://www.darktrace.com/blog/patch-and-persist-darktraces-detection-of-blind-eagle-apt-c-36","date":"2025-06-25"}],"evidenceTotal":18,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-73","name":"External Control of File Name or Path"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43451","tags":["US Government Resource"]}],"techniques":[{"id":"T1566","name":"Phishing","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Crafted file lure triggers hash disclosure","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"NTLM Hash Disclosure Spoofing Vulnerability","start":0,"end":43}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-34ba792326d2a0d92094","title":"Blind Eagle: …And Justice for All","publisher":"research.checkpoint.com","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/","date":"2025-03-10","mentions":[{"quote":"The campaigns are linked to Blind Eagle, also known as APT-C-36, and deliver malicious .url files, which cause a similar effect to the CVE-2024-43451 vulnerability.","start":795,"end":959},{"quote":"CVE-2024-43451 exposes a user’s NTLMv2 hash, which can allow an attacker to authenticate as the user via pass-the-hash or relay attacks.","start":963,"end":1099},{"quote":"On November 12, 2024, Microsoft patched a newly discovered vulnerability, CVE-2024-43451.","start":3969,"end":4058},{"quote":"On devices vulnerable to CVE-2024-43451, a WebDAV request is triggered even before the user manually interacts with the file with the same unusual behavior.","start":4777,"end":4933},{"quote":"CVE-2024-43451 is a vulnerability that exposes a user’s NTLMv2 hash, which can allow an attacker to authenticate as the user via pass-the-hash or relay attacks.","start":5451,"end":5611}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-40720","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-40720","exploited":true,"exploitedSince":"2024-11-12","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2025-01-20","earliestUrl":"https://github.com/RonF98/CVE-2024-43451-POC","repos":[{"name":"RonF98/CVE-2024-43451-POC","url":"https://github.com/RonF98/CVE-2024-43451-POC","stars":15,"created":"2025-01-20"},{"name":"razureink/cve-2024-43451-ntlm_hash_disclosure_reproduction","url":"https://github.com/razureink/cve-2024-43451-ntlm_hash_disclosure_reproduction","stars":0,"created":"2026-07-23"}]},"first":{"date":"2025-01-20","source":"PoC-in-GitHub","url":"https://github.com/RonF98/CVE-2024-43451-POC"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1566"],"provenance":"ai"}],"timeline":[{"date":"2024-11-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43451","provenance":"source"},{"date":"2024-11-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Nov","provenance":"source"},{"date":"2024-11-12","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-11-12","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-40720","provenance":"source"},{"date":"2025-01-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/RonF98/CVE-2024-43451-POC","provenance":"source"},{"date":"2025-03-10","kind":"report","label":"Named in research.checkpoint.com: Blind Eagle: …And Justice for All","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/","provenance":"machine"}],"speed":{"daysToPublicExploit":69,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":81.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 717 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9970"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}