Patch Tuesday: February 2025

After the HUGE updates that were dropped by Microsoft in December and January, February has brought with it a smaller update in comparison - perhaps to match the shortest month!

This month, Microsoft has released updates for just 63 vulnerabilities, including 4 zero day vulnerabilities of which 2 are being actively exploited.  Find the full release from Microsoft here.

Key Updates for February 2025

• 63 vulnerabilities patched
• 4 zero day vulnerabilities, 2 of which are being actively exploited.
  
• 3 critical vulnerabilities, all remote code execution.  

Zero Day Vulnerabilities 

2 of the 4 zero day vulnerabilities are being actively exploited in the wild.

CVE-2025-21391: Windows Storage Elevation of Privilege Vulnerability

• Description: This vulnerability allows an attacker to delete targeted files on a system, potentially leading to service disruptions.
• CVSS Score: 7.1 (High)
• Severity: Important
• Exploitation Status: Actively exploited in the wild.
  
  

CVE-2025-21418: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

• Description: This vulnerability allows an attacker to gain SYSTEM privileges on an affected system.
• CVSS Score: 7.8 (High)
• Severity: Important
• Exploitation Status: Actively exploited in the wild.
  
  

CVE-2025-21194: Microsoft Surface Security Feature Bypass Vulnerability

• Description: This vulnerability affects multiple versions of Microsoft's Surface platform, potentially allowing an attacker to bypass UEFI, which could lead to the compromise of the hypervisor and secure kernel.
• CVSS Score: 7.1 (High)
• Severity: Important
• Exploitation Status: Not currently exploited in the wild.
  
  

CVE-2025-21377: NTLM Hash Disclosure Spoofing Vulnerability

• Description: This vulnerability allows an attacker to obtain a user's NTLMv2 hash, which could be used to authenticate as the user. Exploitation requires minimal user interaction, such as selecting or inspecting a malicious file.
• CVSS Score: 6.5 (Medium)
• Severity: Important
• Exploitation Status: Publicly disclosed; not currently exploited in the wild.

Critical Vulnerability Summary

Alongside the 4 zero-day vulnerabilities released, there are 3 RCE Critical vulnerabilities that need to be addressed:

CVE-2025-21177: Microsoft Dynamics 365 Sales Elevation of Privilege Vulnerability

• Description: This vulnerability allows an authenticated attacker to elevate privileges within the Microsoft Dynamics 365 Sales environment. The attacker can exploit this flaw to gain unauthorized access and perform actions beyond their intended permissions.

• CVSS Score: 8.7 (High)

• Severity: Critical

• Exploitation Status: Not currently exploited in the wild.

  
  

 CVE-2025-21376: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

• Description: This vulnerability allows a remote, unauthenticated attacker to execute arbitrary code on an affected system by sending a specially crafted request to the LDAP server. Successful exploitation could lead to full system compromise.

• CVSS Score: 8.1 (High)

• Severity: Critical

  
  

CVE-2025-21381: Microsoft Excel Remote Code Execution Vulnerability

• Description: This vulnerability allows an attacker to execute arbitrary code on a target system by convincing a user to open a specially crafted Excel file. The attack can be initiated through the Preview Pane, making it possible to exploit without fully opening the file.

• CVSS Score: 7.8 (High)

• Severity: Critical

  
  

CVE-2025-21379: DHCP Client Service Remote Code Execution Vulnerability

• Description: This vulnerability allows an attacker to execute arbitrary code on a target system by sending specially crafted DHCP responses. Exploitation requires the attacker to be on the same network segment as the victim, making it an adjacent network attack.

• CVSS Score: 7.1 (High)

• Severity: Critical

Actions to Take:

> Prioritize Patching for Actively Exploited Zero-Days

• CVE-2025-21391 (Windows Storage EoP) and CVE-2025-21418 (WinSock EoP) are actively exploited.

• Deploy Microsoft’s security patches immediately to prevent potential privilege escalation and targeted attacks.

• Verify patch application through endpoint and vulnerability management tools.

  
  

> Address Critical Remote Code Execution (RCE) Vulnerabilities

• The three critical vulnerabilities (CVE-2025-21376, CVE-2025-21381, and CVE-2025-21379) pose significant risks for remote exploitation.

• Prioritize patching systems running Microsoft Excel, Windows LDAP, and DHCP Client Service.

• Assess exposure, especially for publicly accessible services.

  
  

> Harden NTLM Authentication to Reduce Spoofing Risks

• CVE-2025-21377 (NTLM Hash Disclosure Spoofing) allows attackers to obtain user credentials.

• Enforce NTLM relay protection and use stronger authentication methods like Kerberos.

• Educate users on avoiding interactions with suspicious files or links.

  
  

> Secure Microsoft Surface and UEFI Against Feature Bypass

• CVE-2025-21194 allows attackers to bypass security features in Microsoft Surface devices.

• Implement UEFI firmware updates and enforce security best practices for device hardening.

> Conduct Threat Hunting and Log Analysis

• Review system logs for unusual activity related to privilege escalation or unauthorized access attempts.

• Monitor for unusual DHCP, LDAP, and NTLM authentication requests, as these could indicate exploitation attempts.

• Utilize SIEM solutions to correlate events and detect indicators of compromise (IOCs).

Did you know? You can use the RoboShadow platform to check your Windows Updates as well as patch any outstanding software updates using Cyber Heal.

If you have any questions about Patch Tuesday, or feedback on this blog please
reach out to us: hello@roboshadow.com 

Thanks for reading!