CVE-2025-21311: Windows 11 24h2 Privilege Escalation Flaw

CVE-2025-21311 Overview

CVE-2025-21311 is a critical elevation of privilege vulnerability affecting the Windows NTLM V1 authentication protocol. This vulnerability allows remote attackers to exploit weaknesses in the legacy NTLM V1 implementation to elevate privileges on affected Windows systems without requiring user interaction or prior authentication.

Critical Impact

This vulnerability enables unauthenticated remote attackers to achieve full system compromise through network-based attacks targeting NTLM V1 authentication, potentially leading to complete confidentiality, integrity, and availability impact on affected systems.

Affected Products

• Microsoft Windows 11 24H2
• Microsoft Windows Server 2022 23H2
• Microsoft Windows Server 2025

Discovery Timeline

• 2025-01-14 - CVE-2025-21311 published to NVD
• 2025-01-24 - Last updated in NVD database

Technical Details for CVE-2025-21311

Vulnerability Analysis

This vulnerability resides in the Windows NTLM V1 authentication mechanism, a legacy protocol that has known cryptographic weaknesses compared to newer authentication methods. The flaw is classified under CWE-303 (Incorrect Implementation of Authentication Algorithm), indicating that the vulnerability stems from improper handling of authentication security controls within the NTLM V1 implementation.

The network-accessible nature of this vulnerability makes it particularly dangerous in enterprise environments where NTLM V1 may still be enabled for backward compatibility. Successful exploitation grants attackers elevated privileges without requiring any user interaction, making this an attractive target for automated attack tools and advanced persistent threats.

Root Cause

The root cause of CVE-2025-21311 lies in the incorrect implementation of the authentication algorithm within NTLM V1. The CWE-303 classification indicates that the authentication mechanism fails to properly validate or enforce security controls, allowing attackers to bypass intended privilege restrictions. NTLM V1's inherent cryptographic limitations, combined with this implementation flaw, create an exploitable condition that can be leveraged remotely.

Attack Vector

The attack vector for this vulnerability is network-based with low complexity requirements. An attacker can exploit this vulnerability remotely without requiring any privileges or user interaction on the target system. The attack targets the NTLM V1 authentication handshake process, where the implementation flaw allows privilege escalation beyond what should be authorized.

In a typical attack scenario, an adversary would identify systems with NTLM V1 enabled and craft malicious authentication requests designed to exploit the improper authentication handling. The vulnerability's characteristics make it suitable for use in pass-the-hash style attacks or as part of lateral movement within compromised networks.

Detection Methods for CVE-2025-21311

Indicators of Compromise

• Unusual NTLM V1 authentication attempts from unexpected network sources or at abnormal times
• Anomalous privilege escalation events following NTLM authentication activity
• Authentication logs showing repeated NTLM V1 negotiation attempts from single sources
• Evidence of credential material being used from unauthorized network locations

Detection Strategies

• Monitor Windows Security Event Logs for Event ID 4624 (successful logon) with Logon Type 3 (network) using NTLM authentication package
• Implement network traffic analysis to detect NTLM V1 challenge-response patterns in environments where it should be disabled
• Deploy endpoint detection rules to identify processes gaining elevated privileges following NTLM authentication events
• Enable audit logging for authentication package negotiation to track NTLM version usage across the environment

Monitoring Recommendations

• Configure advanced audit policies to capture detailed NTLM authentication events
• Establish baseline metrics for NTLM V1 usage and alert on deviations
• Monitor for lateral movement patterns that correlate with NTLM authentication activity
• Implement SIEM correlation rules linking authentication anomalies with privilege escalation events

How to Mitigate CVE-2025-21311

Immediate Actions Required

• Apply the security updates provided by Microsoft for all affected Windows systems immediately
• Disable NTLM V1 authentication across all systems and enforce NTLM V2 or Kerberos authentication where possible
• Audit network infrastructure to identify systems still relying on NTLM V1 for compatibility
• Segment networks to limit exposure of critical systems to potential NTLM-based attacks

Patch Information

Microsoft has released security updates to address this vulnerability. Affected organizations should apply patches through Windows Update or download them directly from the Microsoft Security Response Center advisory. Given the critical severity rating and network-based attack vector, prioritize patching for internet-facing systems and domain controllers.

Workarounds

• Configure Group Policy to restrict NTLM authentication to NTLMv2 response only; refuse LM & NTLM via Network security: LAN Manager authentication level
• Enable the Restrict NTLM Group Policy settings to audit and block NTLM traffic across the domain
• Implement network-level segmentation to isolate systems that cannot immediately be patched
• Consider deploying Protected Users security group membership for high-value accounts to prevent NTLM authentication

# Group Policy configuration to disable NTLM V1
# Navigate to: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
# Set "Network security: LAN Manager authentication level" to:
# "Send NTLMv2 response only. Refuse LM & NTLM"

# Registry equivalent (requires restart):
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel /t REG_DWORD /d 5 /f

# Audit NTLM usage before blocking:
# Enable "Network security: Restrict NTLM: Audit NTLM authentication in this domain"
# Enable "Network security: Restrict NTLM: Audit Incoming NTLM Traffic"