EUVD-2025-17746CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Tags
Description
Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
Analysis
Network-accessible denial-of-service vulnerability in Windows DHCP Server caused by a protection mechanism failure (CWE-693), allowing unauthenticated attackers to exhaust server availability without requiring authentication or user interaction. The vulnerability affects Windows DHCP Server implementations across multiple versions and has a CVSS severity of 7.5 (High). While the description does not explicitly reference KEV inclusion, active exploitation status, or EPSS data, the low attack complexity (AC:L) and network accessibility (AV:N) combined with no authentication requirements indicate this represents a credible denial-of-service threat to DHCP infrastructure.
Technical Context
This vulnerability resides in Windows DHCP Server, a critical network infrastructure service responsible for dynamic IP address allocation via the DHCP protocol (RFC 2131/2132 operating over UDP port 67/68). The root cause is classified under CWE-693 (Protection Mechanism Failure), indicating insufficient safeguards against resource exhaustion, malformed packet handling, or inadequate request validation within the DHCP server's packet processing logic. The protection mechanism failure likely involves improper handling of DHCP requests that should be rate-limited, validated, or rejected, allowing an attacker to trigger excessive resource consumption (memory, CPU, or connection state). DHCP servers are fundamental network infrastructure present in virtually all enterprise environments; compromise of this service cascades to network unavailability.
Affected Products
Windows DHCP Server is the primary affected component across Windows Server operating systems. Without access to vendor advisories or CPE strings in the provided data, the likely affected versions include: Windows Server 2016, Windows Server 2019, Windows Server 2022, and potentially earlier/later versions depending on patch status. The vulnerability applies to any deployment where DHCP Server role is active. Typical CPE pattern: cpe:2.3:a:microsoft:windows_dhcp_server:*:*:*:*:*:*:*:* (version range to be confirmed by Microsoft Security Bulletin). Affected configurations include standard DHCP server deployments in enterprise networks, data centers, and cloud environments (Azure, hybrid). Recommendation: Consult Microsoft Security Update Guide (portal.msrc.microsoft.com) for exact KB articles, affected build numbers, and version-specific remediation.
Remediation
Immediate remediation steps: (1) Apply latest security patches from Microsoft for Windows DHCP Server—check Microsoft Security Bulletin and KB database for CVE-2025-32725 specific patch (expected in monthly Patch Tuesday releases); (2) Identify affected systems via Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager; (3) Test patches in non-production environments before broad deployment; (4) Temporary mitigations pending patches: implement network-level ingress filtering to restrict DHCP traffic (UDP 67/68) to authorized networks only, deploy rate-limiting rules on firewalls/network appliances to restrict DHCP request frequency, monitor DHCP server logs for anomalous request patterns, consider disabling DHCP Server role on non-essential systems. (5) Post-remediation: validate DHCP service stability and client connectivity after patching. Reference: Microsoft Security Response Center (MSRC) portal for official advisories, KB articles, and patch availability confirmation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today