Critical Samba RCE Flaw CVE-2025-10230 (CVSS 10.0) Allows Unauthenticated Command Injection on AD DCs

According to the Samba Team, a critical command injection flaw has been disclosed in CVE-2025-10230 (CVSS 10.0) that could allow unauthenticated remote code execution on Samba Active Directory Domain Controllers (AD DCs). The issue stems from insufficient input validation in the WINS server implementation, where the program defined by the “wins hook” parameter is invoked without proper sanitisation when a WINS name is registered or changed.

A malicious client could send a specially crafted NetBIOS name containing shell metacharacters, enabling arbitrary command execution on the affected domain controller without authentication. The vulnerability affects systems where the WINS server feature is enabled with a non-empty wins hook parameter, and other Samba servers are not impacted.

As mitigations, administrators are advised to avoid setting the wins hook parameter in smb.conf on domain controllers, or to disable WINS entirely, with Samba noting the default wins support value is no and that the wins hook functionality is largely deprecated. 16 October 2025