CVE-2025-21293 – Privilege Escalation Vulnerability and Mitigation
CVE-2025-21293 represents a privilege escalation vulnerability in Microsoft Active Directory Domain Services (AD DS) that allows attackers to gain SYSTEM-level privileges within a Windows environment.
The vulnerability stems from misconfigured permissions on the built-in Network Configuration Operators group, which can create registry subkeys for critical services like DnsCache and NetBT without full administrative rights. Attackers leverage this to register malicious DLLs via Windows Performance Counters, executed with SYSTEM privileges.
How the Exploit Works
- Attackers use "CreateSubKey" permission to modify Windows registry keys for performance monitoring services
- Malicious DLLs are registered as performance counter libraries linked to services like DnsCache
- When performance counters are queried (via WMI), Windows loads these DLLs with SYSTEM-level privileges, enabling escalation
Impact
Active Directory's critical role in corporate networks means exploitation allows local privilege elevation, enabling credential harvesting via SAM and LSASS dumping, lateral movement, and potential domain compromise.
Affected Windows Versions
- Windows 10 (32-bit) – versions 1607, 1809, 21H2, 22H2
- Windows 10 (64-bit) – versions 1607, 1809, 21H2, 22H2
- Windows 10 (ARM64) – 21H2, 22H2
- Windows 11 (64-bit) – 22H2, 23H2, 24H2
- Windows 11 (ARM64) – 22H2, 23H2, 24H2
- Windows Server – 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025
Remediation Guidelines
- Microsoft released a security patch in January 2025 Patch Tuesday; immediate application is strongly recommended
- Administrators should verify only trusted users belong to Network Configuration Operators group, as membership grants sensitive privileges
The vulnerability demonstrates the importance of reviewing and tightening default group permissions in Active Directory environments and keeping security patches up to date to prevent privilege escalation attacks.
Contact NaviSec to set up a time to talk about our penetration testing services.