CVE-2024-43451: Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability (Pentest Lab Guide)

CVE-2024-43451: Technical Deep-Dive (Auto Refreshed)

Generated on 2026-03-21T05:04:43.176Z. This file is automatically regenerated every 30 minutes by the CVE AI enrichment job using web sources (NVD, MITRE, CISA KEV, GitHub).

Executive Technical Summary

NTLM Hash Disclosure Spoofing Vulnerability

Context preserved from previous revision: NTLM Hash Disclosure Spoofing Vulnerability Notes: CVE-2024-43451 is a Windows NTLM vulnerability that allows an attacker to force authentication and capture NTLM hashes by using malicious shortcuts.

Technical Details

CVE: CVE-2024-43451
KEV date added: 2024-11-12
KEV due date: 2024-12-03
NVD published: 2024-11-12
NVD modified: 2025-10-28
MITRE modified: 2025-10-21
CVSS base score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS exploitability score: 2.8
CVSS impact score: 3.6
Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

Versions and Products Impacted

microsoft / windows 10 1507 (versions: < 10.0.10240.20826)
microsoft / windows 10 1607 (versions: < 10.0.14393.7515)
microsoft / windows 10 1809 (versions: < 10.0.17763.6532)
microsoft / windows 10 21h2 (versions: < 10.0.19044.5131)
microsoft / windows 10 22h2 (versions: < 10.0.19045.5131)
microsoft / windows 11 22h2 (versions: < 10.0.22621.4460)
microsoft / windows 11 23h2 (versions: < 10.0.22631.4460)
microsoft / windows 11 24h2 (versions: < 10.0.26100.2314)
microsoft / windows server 2008
microsoft / windows server 2008 (versions: r2)
microsoft / windows server 2012
microsoft / windows server 2012 (versions: r2)
microsoft / windows server 2016 (versions: < 10.0.14393.7515)
microsoft / windows server 2019 (versions: < 10.0.17763.6532)
microsoft / windows server 2022 (versions: < 10.0.20348.2849)
microsoft / windows server 2022 23h2 (versions: < 10.0.25398.1251)
microsoft / windows server 2025 (versions: < 10.0.26100.2314)
Microsoft / Windows Server 2025 (versions: 10.0.26100.0)
Microsoft / Windows Server 2025 (Server Core installation) (versions: 10.0.26100.0)
Microsoft / Windows 10 Version 1809 (versions: 10.0.17763.0)

Weakness Classification

CWE-73
NVD-CWE-noinfo

Repositories for Lab Validation (Public Examples)

RonF98/CVE-2024-43451-POC | stars: 15 | updated: 2025-07-29 | https://github.com/RonF98/CVE-2024-43451-POC
Notes: CVE-2024-43451 is a Windows NTLM vulnerability that allows an attacker to force authentication and capture NTLM hashes by using malicious shortcuts.
ThreatIntelligenceLab/collection-cybersecurity-papers | stars: 10 | updated: 2025-09-16 | https://github.com/ThreatIntelligenceLab/collection-cybersecurity-papers
Notes: A massive collection of Cybersecurity papers, guides and reports.
mclperera/patchintel | stars: 0 | updated: 2025-11-16 | https://github.com/mclperera/patchintel
packetinside/CISA_BOT | stars: 0 | updated: 2025-08-08 | https://github.com/packetinside/CISA_BOT
Notes: CISA Bot is a GitHub bot that automatically monitors the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. When new vulnerabilities are published in the KEV, the bot creates GitHub issues in this repository with detailed information about each vulnerability.

People and Organizations Mentioned

microsoft
Windows
RonF98
ThreatIntelligenceLab
mclperera
packetinside

Practical Defensive Validation (Authorized Only)

Use only isolated environments and systems you own or are explicitly authorized to test.
Snapshot infrastructure before validation and preserve baseline logs (EDR, SIEM, OS, app).
Inventory microsoft / windows 10 1507 (versions: < 10.0.10240.20826) assets and confirm exact vulnerable versions with automated checks.
Patch in staged environments and validate closure with scanners + service health checks.
Map detections to MITRE ATT&CK tactics relevant to your environment and tune alert quality.

References

NVD record: https://nvd.nist.gov/vuln/detail/CVE-2024-43451
MITRE CVE record: https://www.cve.org/CVERecord?id=CVE-2024-43451
CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
CISA KEV JSON feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
KEV notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43451
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43451
Repository example: https://github.com/RonF98/CVE-2024-43451-POC
Repository example: https://github.com/ThreatIntelligenceLab/collection-cybersecurity-papers
Repository example: https://github.com/mclperera/patchintel
Repository example: https://github.com/packetinside/CISA_BOT

This content is for defensive security training and authorized validation only.