CVE-2023-21689CWE-122

CVE-2023-21689

Critical · published February 15, 2023

CVSS v3.1
9.8
EPSS
27%
Percentile
98.0
In the wild
Unconfirmed
What it is

🚨 A chilling flaw in Microsoft's PEAP could let attackers remotely execute code—this is bad news for anyone relying on secure networks! 🔥 Think of this vulnerability like a hotel with an unlocked backdoor—once inside, an intruder has the run of the place without any checks. All it takes is the right approach to gain unauthorized access! An attacker could exploit this vulnerability to execute arbitrary commands on your network, potentially leading to complete system compromise. This means they could manipulate data, install malicious software, or even take control of sensitive information, resulting in catastrophic breaches.

Put simply

Think of this vulnerability like a hotel with an unlocked backdoor—once inside, an intruder has the run of the place without any checks. All it takes is the right approach to gain unauthorized access! This critical vulnerability in Microsoft's Protected Extensible Authentication Protocol (PEAP) allows unauthenticated attackers to execute remote code by sending specially crafted authentication requests. Essentially, it bypasses security measures that are supposed to keep your network safe.

What to do

An attacker could exploit this vulnerability to execute arbitrary commands on your network, potentially leading to complete system compromise. This means they could manipulate data, install malicious software, or even take control of sensitive information, resulting in catastrophic breaches. Immediately apply the security update provided by Microsoft to mitigate this vulnerability. Ensure that all networking devices and authentication systems are configured correctly to prevent unauthorized access. Regularly audit your network's security settings to catch potential risks early. You've got this! Patch up your systems, and you'll be a hero in the fight against cyber threats! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.26702 · 98.0th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2023-02-15T01:15Z
Affected products (28)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1974710.0.10240.19747
microsoft/windows_10_1507< 10.0.10240.1974710.0.10240.19747
microsoft/windows_10_1607< 10.0.14393.571710.0.14393.5717
microsoft/windows_10_1607< 10.0.14393.571710.0.14393.5717
microsoft/windows_10_1809< 10.0.17763.401010.0.17763.4010
microsoft/windows_10_1809< 10.0.17763.401010.0.17763.4010
microsoft/windows_10_1809< 10.0.17763.401010.0.17763.4010
microsoft/windows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoft/windows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoft/windows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoft/windows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoft/windows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoft/windows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoft/windows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoft/windows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoft/windows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoft/windows_11_21h2< 10.0.22000.157410.0.22000.1574
microsoft/windows_11_21h2< 10.0.22000.157410.0.22000.1574
microsoft/windows_11_22h2< 10.0.22621.126510.0.22621.1265
microsoft/windows_11_22h2< 10.0.22621.126510.0.22621.1265
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016all versions—
microsoft/windows_server_2019all versions—
microsoft/windows_server_2022all versions—
References (2)
EPSS history
Timeline
  • 14 FEB 19:33Z
    Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
    cvelistv5