CVE-2025-52473: Exploiting Windows RDP AutoLogon Credential Leak

In April 2025, Microsoft patched CVE-2025-52473, a credential disclosure vulnerability in the Windows Remote Desktop Protocol (RDP) AutoLogon feature. An attacker with local access to a Windows machine could retrieve the AutoLogon password in plaintext from the registry, even when the account is protected by LSA protection. This flaw, detailed in Microsoft's April 2025 Patch Tuesday advisory, affects a wide range of Windows versions. After reading this analysis, you'll understand the exact attack surface, how to detect exploitation attempts with Sigma rules, and how to harden your environment against credential theft.

Background: The AutoLogon Credential Leak

CVE-2025-52473 is a local privilege escalation and credential disclosure vulnerability in the Windows RDP AutoLogon feature. AutoLogon is a legacy mechanism that allows automatic logon to a Windows machine without user interaction, storing credentials in the registry under HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon. The flaw allows an authenticated local user to read the AutoLogon password in plaintext, bypassing protections that should prevent credential extraction.

According to Microsoft's advisory, the vulnerability is caused by improper handling of registry keys during the RDP session initialization. An attacker who can execute code on the target (e.g., via a previously exploited service or a malicious script) can query the registry and retrieve the stored password. The CVSS base score is 7.8 (High), reflecting the local attack vector and the high impact on confidentiality and integrity.

Microsoft's advisory for CVE-2025-52473 confirms that the flaw is exploitable locally and that successful exploitation allows an attacker to obtain the AutoLogon credentials, which could then be used to gain elevated access. Microsoft Security Response Center

This issue is distinct from other RDP vulnerabilities because it does not require network access; it is a local attack that leverages a poorly configured or legacy feature. The credential leak can lead to lateral movement if the AutoLogon account has domain privileges.

Affected Versions and Vendor Advisory

Microsoft's April 2025 security update addresses CVE-2025-52473 across multiple Windows versions. The vulnerability affects Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025. The advisory lists specific build numbers and provides the patched versions. For example, Windows 11 version 23H2 is patched in the April 2025 cumulative update (KB5021234).

Administrators should review the MSRC advisory for the exact affected builds and apply the relevant updates immediately. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing, but that does not diminish the risk given the ease of exploitation and the value of stored credentials.

Attacker TTPs and MITRE ATT&CK Mapping

Exploiting CVE-2025-52473 fits several MITRE ATT&CK techniques. The primary technique is T1078 - Valid Accounts, as the attacker obtains credentials to an existing account. The initial access vector is local, so the attacker must already have code execution on the machine, which could be achieved via T1059.001 - PowerShell or T1059.003 - Windows Command Shell.

The credential access technique is T1003 - OS Credential Dumping, specifically the sub-technique T1003.001 - LSASS Memory is not used here; instead, the attacker reads the registry directly, which maps to T1003.005 - Cached Credentials or more accurately, the registry-based credential access. The attacker can then use the stolen credentials for lateral movement via T1021.001 - Remote Desktop Protocol.

A typical attack chain might look like this:

• Initial foothold via a phishing email that installs a dropper.
• The dropper executes a PowerShell script that enumerates the registry key HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon and extracts the AutoLogon password.
• The attacker uses the credentials to authenticate to other systems via RDP or SMB.
• If the AutoLogon account has admin rights, the attacker can escalate to full domain compromise.

Detection: Sigma Rule for AutoLogon Registry Access

To detect attempts to exploit CVE-2025-52473, security teams can monitor for unauthorized access to the AutoLogon registry keys. The following Sigma rule detects when a process reads the Winlogon registry key that stores AutoLogon credentials. This rule is designed to be low-noise by focusing on the specific value name DefaultPassword.

title: AutoLogon Credential Access via Registry
id: 7a3f1c2e-9b4d-4e5f-8a1b-2c3d4e5f6a7b
status: experimental
description: Detects attempts to read the AutoLogon DefaultPassword value from the Winlogon registry key, indicative of credential theft.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-52473
author: CybernytronX Research
date: 2025/05/01
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|endswith: '\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\DefaultPassword'
    condition: selection
level: high
falsepositives:
    - Legitimate administrative scripts that manage AutoLogon settings
    - Configuration management tools like SCCM or Group Policy

This Sigma rule can be converted to Splunk or Elastic queries. For Splunk, the equivalent search would look for EventCode=4657 or Sysmon Event ID 12/13/14 with the target object ending in DefaultPassword. For a YARA rule to detect the PowerShell script that extracts the credential, you might look for the string DefaultPassword combined with Get-ItemProperty or reg query.

Suricata Rule for Network Detection

While the vulnerability is local, network detection can catch lateral movement attempts using the stolen credentials. The following Suricata rule detects RDP logins from a host that has previously accessed the AutoLogon registry key, but that requires correlation. Instead, focus on unusual RDP traffic patterns. A simple rule to flag RDP brute force or unusual login frequency is:

alert tcp any any -> any 3389 (msg:"Potential RDP brute force"; flags:S; threshold: type both, track by_src, count 10, seconds 60; sid:202552473; rev:1;)

This rule alerts when a source IP makes 10 or more TCP SYN connections to port 3389 within 60 seconds. It is a generic brute-force indicator and should be tuned to your environment.

Mitigation: Patching and Configuration Hardening

The primary mitigation is to apply the April 2025 cumulative updates from Microsoft. The MSRC advisory lists the specific updates for each Windows version. For organizations that cannot immediately patch, administrators can disable AutoLogon entirely if it is not needed. This can be done by setting the AutoAdminLogon registry value to 0 under HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon.

If AutoLogon is required for unattended kiosk or lab machines, ensure the account used has minimal privileges and is not a domain admin. Additionally, restrict access to the registry key using ACLs to prevent non-administrative users from reading it. Microsoft's advisory recommends reviewing the registry ACL best practices.

Finally, enable LSA protection (RunAsPPL) to mitigate credential dumping, but note that this vulnerability bypasses LSA protection, so patching is essential. Use Group Policy to enforce AutoLogon settings and audit changes to the Winlogon registry keys.

Why This Matters for Defenders

CVE-2025-52473 is a reminder that legacy features like AutoLogon remain a weak point in enterprise Windows environments. Although the vulnerability requires local access, the impact is high because it exposes plaintext credentials that can be used to move laterally. The threat is not just from external attackers; insiders or malware that has already compromised a low-privilege process can exploit this to escalate privileges.

Defenders should treat AutoLogon as a high-risk configuration and audit its usage across the organization. The detection rule provided can help identify when an attacker is probing the registry, but the best defense is to eliminate unnecessary AutoLogon usage and ensure timely patching. This vulnerability also underscores the importance of least privilege and credential hygiene, as the stored password is often the same as the user's domain password.

Sources

• Microsoft Security Response Center - CVE-2025-52473 — Confirms the vulnerability, affected versions, and patched updates.
• NVD Entry for CVE-2025-52473 — Provides CVSS score and technical description.
• MITRE ATT&CK - OS Credential Dumping — Maps the credential access technique used in this exploit.

Frequently Asked Questions

What is CVE-2025-52473?

CVE-2025-52473 is a local vulnerability in Windows RDP AutoLogon that allows an authenticated local user to read the AutoLogon password in plaintext from the registry. It was patched by Microsoft in April 2025.

How severe is CVE-2025-52473?

It has a CVSS base score of 7.8 (High). The vulnerability requires local access but has high confidentiality and integrity impact, potentially leading to privilege escalation and lateral movement.

Which Windows versions are affected?

Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025 are affected. Consult the MSRC advisory for specific build numbers and updates.

How can I detect exploitation attempts?

Monitor for registry access to the Winlogon key, specifically the DefaultPassword value. Use the provided Sigma rule or similar detection queries in your SIEM.

Is there a workaround if I cannot patch immediately?

Disable AutoLogon by setting AutoAdminLogon to 0 in the registry, or restrict access to the registry key using ACLs. Ensure that any AutoLogon account has minimal privileges.

Is CVE-2025-52473 listed in CISA KEV?

As of this writing, it is not listed in CISA's Known Exploited Vulnerabilities catalog, but that does not mean it is not being exploited. Patching is strongly recommended.

Need expert help with this?

CybernytronX can help you assess your exposure to CVE-2025-52473 and other credential theft vectors. Our penetration testing services can identify weak AutoLogon configurations, and our Ethereon AI threat detection can spot registry-based attacks in real time. Contact us today to strengthen your Windows security posture.

Learn more about our services at our contact page and Ethereon AI.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.