Critical Samba Flaw Allows Remote Attackers to Execute Arbitrary Code
A vulnerability has been identified in the Samba WINS server hook script that allows unauthenticated attackers to execute arbitrary commands on affected domain controllers.
A vulnerability has been identified in the Samba WINS server hook script that allows unauthenticated attackers to execute arbitrary commands on affected domain controllers.
This critical flaw, identified as CVE-2025-10230, has a CVSSv3.1 score of 10.0, indicating its high impact on confidentiality, integrity, and availability. The issue occurs when Samba’s WINS support is enabled and a domain controller specifies a wins hook parameter in its smb.conf configuration. Under these conditions, any changes to a WINS name can trigger the specified program without proper input validation.
CVE ID Affected Versions CVSS 3.1 Score Impact Summary
CVE-2025-10230 All versions since 4.0 10.0 Unauthenticated remote code execution via crafted WINS name on AD controllers
The vulnerability arises because the WINS server passes names directly into a shell command, allowing attackers to craft a malicious NetBIOS name containing shell metacharacters. This results in the execution of the injected payload with system-level permissions.
By default, wins support is disabled, but it is often enabled to integrate legacy applications. The vulnerability impacts all Samba versions from 4.0 onward when running as an Active Directory Domain Controller with WINS support. Other roles or standalone servers that use a different WINS server implementation are not affected.
This critical flaw, identified as CVE-2025-10230, has a CVSSv3.1 score of 10.0, indicating its high impact on confidentiality, integrity, and availability.
The flaw is critical due to network exposure, lack of authentication requirements, and full system control upon exploitation. Remote attackers do not require valid credentials, and no user interaction is needed beyond sending a specially crafted WINS request. This poses significant risks, including data theft, backdoor installation, ransomware deployment, or complete infrastructure takeover.
Organizations running Samba as a domain controller with WINS enabled should address this vulnerability urgently.
Patches for Samba versions 4.23.2, 4.22.5, and 4.21.9 are available. Administrators are advised to upgrade immediately or apply the official patch from Samba’s security page.
Where immediate updating is not possible, removing or disabling the wins hook parameter is an effective workaround, provided WINS support remains enabled. This can be achieved by setting:
wins hook =
in the smb.conf file, which prevents command invocation. Alternatively, disabling WINS support entirely with wins support = no restores default behavior, though it may affect legacy name resolution.
Administrators should audit their domain controllers’ configurations to ensure no unnecessary hooks are present. Future Samba releases may eliminate deprecated WINS hook functionality, so long-term deployment plans should reconsider reliance on this mechanism.
CVE-2025-10230 presents a severe risk to organizations using Samba AD Domain Controllers with WINS support. Immediate action, such as applying updates or disabling the vulnerable configuration, is required to safeguard networks and maintain the integrity of critical directory services.
Based on reporting by GBHackers.