Description

CVE-2025-23120 is a Remote Code Execution (RCE) vulnerability affecting domain users. While the CVSS score is high at 9.9, the SOCRadar Vulnerability Risk Score (SVRS) is 52. This indicates that, based on SOCRadar's vulnerability intelligence which incorporates real-world factors beyond the quantitative CVSS score, the immediate risk might be lower than the CVSS suggests, but still requires attention.

Key Insights

• Remote Code Execution: The vulnerability allows attackers to execute arbitrary code remotely, which can lead to complete system compromise, data theft, and denial of service.
• Domain User Impact: Since the vulnerability impacts domain users, a successful exploit can grant the attacker elevated privileges within the network, enabling lateral movement and access to sensitive resources.
• SVRS Consideration: While the CVSS score indicates critical severity, the SVRS of 52 suggests that the real-world exploitability and impact, based on available threat intelligence, is moderate. This score reflects factors such as the lack of active exploits (if applicable), specific threat actor targeting (if applicable), and limited mentions in relevant threat landscapes.
• Active Exploits have been published.

Mitigation Strategies

• Patch Management: Immediately apply any available patches or updates provided by the vendor to address the vulnerability. This is the primary and most effective mitigation strategy.
• Privilege Restriction: Implement the principle of least privilege, ensuring that domain users only have the necessary permissions to perform their job functions. Restricting unnecessary administrative privileges can limit the impact of a successful exploit.
• Network Segmentation: Segment the network to isolate critical systems and data. This can prevent an attacker from easily moving laterally across the network after exploiting the vulnerability.
• Intrusion Detection and Prevention: Deploy and configure Intrusion Detection and Prevention Systems (IDS/IPS) to detect and block attempts to exploit the vulnerability. Ensure that these systems are regularly updated with the latest signatures.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.