Product:
SMB Server
Summary
SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make users subject to elevation of privilege attacks. Microsoft is releasing this CVE to provide customers with audit capabilities to help assess their environment and identify potential device or software incompatibility issues before deploying SMB Server hardening measures.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-55234 |
Exploitation
To exploit this vulnerability, an attacker must have network access to the SMB Server and be able to manipulate the SMB protocol. By leveraging the relay attack, the attacker can intercept and relay authentication requests, potentially gaining elevated privileges on the target system. Successful exploitation requires the attacker to have some level of user interaction, making it crucial to target users who are likely to authenticate to the SMB Server.
Affected Products
- SMB Server: Vulnerable to relay attacks if not properly configured.
Mitigation
To mitigate this vulnerability, it is advised to enable SMB Server hardening measures such as SMB Server signing and Extended Protection for Authentication (EPA). Customers should assess their environment using the audit capabilities provided in the September 2025 security updates and adopt appropriate hardening measures to protect against relay attacks.