Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2025-10230

CriticalPublished

Samba: command injection in wins server hook script

Published: Nov 7, 2025
Updated: Aug 31, 2026
Assigning CNA: redhat
Evidence observed: Aug 8, 2026

Primary CVSS

10.0/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS probability estimate

39.7%

Moderate · next 30 days

Percentile: 98.6%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

Sources

CVE-2025-10230PoC
Proof-of-concept exploit for CVE-2025-10230, a Samba WINS hook command injection vulnerability, demonstrating limited 15-character command execution.
CVE-2025-10230Research
OS command injection vulnerability in Samba that received the maximum possible CVSS v3.1 score of 10.0
CVE-2025-10230PoC
CVE-2025-10230 PoC - Samba WINS Hook Command Injection

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.