CVE-2023-21690CWE-122

CVE-2023-21690

Critical · published February 15, 2023

CVSS v3.1
9.8
EPSS
28%
Percentile
98.1
In the wild
Unconfirmed
What it is

🚨 A single vulnerability in Microsoft’s PEAP could let an attacker run code remotely — it’s like handing over the keys to your digital fortress! 🔥 Think of it as a hotel with an overly trusting front desk that gives out master keys to anyone who asks, allowing unauthorized access to every room. This vulnerability means a crafty attacker could slip right in and take control of sensitive systems, leaving a trail of chaos in their wake. If exploited, this flaw could allow attackers to execute arbitrary code on affected systems, leading to unauthorized access, data theft, or even complete system compromise. The potential fallout is absolutely devastating, giving malicious actors a direct line to sensitive information and critical infrastructure.

Put simply

Think of it as a hotel with an overly trusting front desk that gives out master keys to anyone who asks, allowing unauthorized access to every room. This vulnerability means a crafty attacker could slip right in and take control of sensitive systems, leaving a trail of chaos in their wake. This vulnerability arises from improper handling of authentication requests within the Microsoft Protected Extensible Authentication Protocol (PEAP), allowing remote code execution by an unauthenticated attacker.

What to do

If exploited, this flaw could allow attackers to execute arbitrary code on affected systems, leading to unauthorized access, data theft, or even complete system compromise. The potential fallout is absolutely devastating, giving malicious actors a direct line to sensitive information and critical infrastructure. Immediate steps include applying the latest security updates provided by Microsoft and conducting a thorough audit of your network to ensure PEAP configurations are properly secured. It’s vital to monitor logs for any unusual authentication requests that may signal attempted exploitation. You've got this! Secure your systems now and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.27737 · 98.1th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2023-02-15T01:15Z
Affected products (28)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1974710.0.10240.19747
microsoft/windows_10_1507< 10.0.10240.1974710.0.10240.19747
microsoft/windows_10_1607< 10.0.14393.571710.0.14393.5717
microsoft/windows_10_1607< 10.0.14393.571710.0.14393.5717
microsoft/windows_10_1809< 10.0.17763.401010.0.17763.4010
microsoft/windows_10_1809< 10.0.17763.401010.0.17763.4010
microsoft/windows_10_1809< 10.0.17763.401010.0.17763.4010
microsoft/windows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoft/windows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoft/windows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoft/windows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoft/windows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoft/windows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoft/windows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoft/windows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoft/windows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoft/windows_11_21h2< 10.0.22000.157410.0.22000.1574
microsoft/windows_11_21h2< 10.0.22000.157410.0.22000.1574
microsoft/windows_11_22h2< 10.0.22621.126510.0.22621.1265
microsoft/windows_11_22h2< 10.0.22621.126510.0.22621.1265
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016all versions—
microsoft/windows_server_2019all versions—
microsoft/windows_server_2022all versions—
References (2)
EPSS history
Timeline
  • 14 FEB 19:33Z
    Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
    cvelistv5