CVE-2025-10230

CVE-2025-10230 is an OS command injection flaw (CWE-78) in the front-end WINS hook handling of Samba. When the Samba Active Directory Domain Controller processes WINS registration packets, NetBIOS name data taken from the packet is inserted into a shell command without validation or escaping, so an unauthenticated network attacker can inject shell metacharacters and commands. Successful exploitation yields remote command execution as the Samba process on the server, with critical impact (CVSS 3.1 score 10.0). Any Samba deployment acting as an AD DC or otherwise running the WINS service with a wins hook configured is affected. The flaw is not yet listed in CISA KEV and no public proof-of-concept is known, but EPSS assigns a high 39.7% probability of exploitation within 30 days.

What to do: Upgrade Samba to the patched release published by the Samba Team or your distribution/vendor as soon as it is available, since no fixed version is stated in this data. As an interim mitigation, restrict access to the NetBIOS name service ports (UDP/TCP 137) from untrusted networks and audit smb.conf for 'wins support = yes' and a configured 'wins hook'. Prioritize patching AD DCs and other Samba WINS servers exposed to untrusted networks, given the flaw requires no authentication and the high EPSS score.