Full Report
Microsoft has released its monthly security update for January of 2025 which includes 159 vulnerabilities, including 10 that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.”
Analysis Summary
# Vulnerability: Key Flaws in Microsoft January 2025 Security Updates (RCE, EoP, Bypass)
## CVE Details
*Note: This summary focuses on the detailed CVEs provided in the text, prioritizing Critical (CVSS 9.0+) and high-impact CVEs.*
| CVE ID | CVSS Score | Severity | CWE |
| :--- | :--- | :--- | :--- |
| CVE-2025-21298 | 9.8 | Critical | N/A (RCE via OLE) |
| CVE-2025-21307 | N/A | Critical | N/A (RCE via RMCAST) |
| CVE-2025-21362 | N/A | Critical | N/A (RCE via Excel) |
| CVE-2025-21295 | N/A | Critical | N/A (RCE via NEGOEX) |
| CVE-2025-21311 | N/A | Critical | N/A (Privilege Escalation via NTLMv1) |
| CVE-2025-21294 | N/A | Critical | N/A (RCE via Digest Auth) |
| CVE-2025-21309 | 8.1 | Important/Critical* | N/A (RCE via RD Services) |
| CVE-2025-21296 | N/A | Critical | N/A (RCE via BranchCache) |
| CVE-2025-21297 | N/A | Critical | N/A (RCE via RD Services) |
*Note: CVE-2025-21309 is listed as "critically rated" but has a CVSS score of 8.1 (High).*
## Affected Systems
- **Products:** Windows, Windows Server, Microsoft Outlook, Microsoft Excel, Azure Marketplace SaaS Resources, Microsoft Purview.
- **Versions:** Multiple versions of Windows and Windows Server are affected by various flaws disclosed in the January 2025 updates. Specific versions are not detailed but implied to be those receiving the January patch.
- **Configurations:**
* **CVE-2025-21309:** Systems with the Remote Desktop Gateway role enabled.
* **CVE-2025-21294:** Requires winning a race condition.
* **CVE-2025-21296:** Attacker must be on the same network.
* **CVE-2025-21297:** Requires winning a race condition.
## Vulnerability Description
This set of updates addresses 159 vulnerabilities, including 12 critical severity flaws. Key technical details include:
1. **RCE via OLE (CVE-2025-21298):** An attacker can achieve arbitrary code execution by sending a malicious email (potentially an RTF attachment) to a victim running vulnerable Outlook. Exploitation can occur when the victim merely *previews* the email.
2. **RCE via RD Services (CVE-2025-21309):** Remote Code Execution vulnerability affecting systems with the Remote Desktop Gateway role enabled. Microsoft flags this as "more likely to be exploited."
3. **RCE via Digest Authentication (CVE-2025-21294):** A critical flaw requiring the attacker to win a race condition to execute arbitrary code.
4. **RCE via NEGOEX (CVE-2025-21295):** Remotely exploitable RCE flaw in the SPNEGO Extended Negotiation mechanism requiring no user interaction.
5. **RCE via RMCAST (CVE-2025-21307):** Unauthenticated attacker can achieve RCE by sending a specially crafted packet to vulnerable systems utilizing the Reliable Multicast Transport Driver.
6. **Privilege Escalation via NTLMv1 (CVE-2025-21311):** Remotely exploitable flaw allowing an attacker to escalate privileges.
7. **RCE via Excel (CVE-2025-21362):** RCE in Excel, triggerable via file opening or the preview pane.
## Exploitation
- **Status:**
* **CVE-2025-21309:** Microsoft marks as "more likely to be exploited."
* **CVE-2025-21298 (OLE RCE):** Implies high risk due to simple triggering mechanism (email preview).
* **CVE-2025-21380 / CVE-2025-21385 (Info Disclosure):** Microsoft reports these have already been mitigated pre-patch release.
* Status for all others is generally unstated, but many are RCEs requiring minimal interaction, suggesting high exploit potential.
- **Complexity:** Varies. CVE-2025-21295 (NEGOEX) requires no user interaction (Low complexity for network access). CVE-2025-21294/21297 require winning a race condition (Medium/High complexity).
- **Attack Vector:** Remote (Network) for most RCEs (RD Services, NEGOEX, RMCAST, OLE). Local for Privilege Escalation (NTLMv1).
## Impact
- **Confidentiality:** Medium to High (Information Disclosure via CVE-2025-21380/21385, Arbitrary Code Execution leading to full compromise).
- **Integrity:** High (Arbitrary Code Execution grants full control over system state).
- **Availability:** High (Arbitrary Code Execution can lead to system service disruption or total compromise).
## Remediation
### Patches
All vulnerabilities mentioned were addressed in Microsoft's **January 2025 Security Update**. Customers are urged to apply all bundled updates immediately.
### Workarounds
- **CVE-2025-21298 (OLE RCE):** Disable Rich Text Format (RTF) handling/processing in vulnerable Outlook versions.
- **CVE-2025-21311 (NTLMv1 PE):** Disable the use of NTLMv1 protocol.
## Detection
- **Indicators of Compromise:** Monitoring for unusual network activity targeting Remote Desktop Gateway services, unexpected process execution originating from Outlook or Excel following file interaction, and anomalous network connection attempts related to services running on RDP ports or multicast addressing (RMCAST).
- **Detection methods and tools:**
* Talos has released new Snort rules to detect exploitation attempts: **Snort Rules 64432 – 64436, 64444 - 64457**, and **Snort 3 Rules 301113, 301114, 301117 - 301123**.
* Cisco Security Firewall customers must update their SRU.
## References
- [Microsoft Security Update Guide (January 2025)](msrc.microsoft.com/update-guide/) (Please replace with the actual defanged URL)