A vulnerability in Foxit PDF Editor and Reader allows an attacker to force unauthorized SMB authentication, potentially resulting in the theft of user credential hashes.

This is a protection mechanism failure where the application fails to enforce secure reading mode permissions. An unauthenticated attacker can craft a malicious PDF that triggers external SMB authentication without user interaction, leading to credential hash exposure.

The exposure of NTLM or other credential hashes poses a significant risk to organizational security, as these hashes can be cracked offline or used in relay attacks to gain unauthorized access to internal network resources. While the CVSS score of 6.1 represents a medium severity, the potential for lateral movement following a credential harvest warrants prompt attention to protect sensitive user identity data.

Immediate Action: Update all installations of Foxit PDF Editor and Foxit PDF Reader to the latest available versions provided by the vendor.

Proactive Monitoring: Review network egress logs for unexpected SMB traffic originating from workstations running PDF software.

Compensating Controls: Disable NTLM authentication at the network level or enforce SMB signing/encryption via Group Policy to prevent the utility of captured hashes in relay attacks.

Public Exploit Available: Unknown

Organizations should prioritize patching Foxit PDF software across all endpoints to mitigate this credential exposure risk. Given the ease with which users can be phished into opening malicious PDF files, applying the vendor updates is the most effective way to restore secure reading mode protections and prevent unauthorized authentication attempts.