CVE-2025-52488

CVE-2025-52488 is an information-disclosure flaw in DNN Platform (formerly DotNetNuke), an open-source .NET-based web CMS, that allows a specially crafted series of malicious interactions to expose NTLM authentication hashes. An unauthenticated network attacker can trigger the DNN web server to authenticate to a third-party (attacker-controlled) SMB server, capturing the NTLM hashes of the account running the application. Those hashes can be cracked offline or relayed to other services, potentially yielding valid credentials for the web server's service account and broader movement in Windows/Active Directory environments — consistent with the scope-changed, high-confidentiality CVSS 3.1 score of 8.6. All DNN Platform deployments from version 6.0.0 up to but not including 10.0.1 are affected, especially Windows-hosted servers whose application pool identity is a domain or service account, since those hashes are the most valuable to an attacker. Exploitation has not yet been confirmed (not in CISA KEV, no public PoC), but EPSS assigns a 35.2% probability of exploitation within 30 days (98th percentile), making this a high-priority patch.

What to do: Upgrade DNN Platform to version 10.0.1 or later as soon as possible. As interim mitigation, restrict outbound SMB (TCP 445) from web servers to trusted destinations only and run the application pool under a low-privilege, non-domain account so leaked hashes have limited value; monitor for unexpected SMB connections to external hosts. Given the high EPSS score, prioritize patching of internet-exposed DNN instances.