CVE-2023-21692CWE-122

CVE-2023-21692

Critical Β· published February 15, 2023

CVSS v3.1
9.8
EPSS
21%
Percentile
97.6
In the wild
Unconfirmed
What it is

🚨 A single crafted authentication request could lead to full remote code execution! This vulnerability in Microsoft's PEAP is alarmingly critical! πŸ”₯ Think of this as a hotel where anyone can check in simply by presenting a fake reservation β€” once inside, they could access any room and take whatever they want! An attacker could exploit this vulnerability to execute arbitrary code on affected systems, potentially gaining complete control over the network. This means they could access sensitive data, install malware, or disrupt critical services. It’s absolutely devastating if left unaddressed!

Put simply

Think of this as a hotel where anyone can check in simply by presenting a fake reservation β€” once inside, they could access any room and take whatever they want! This vulnerability allows remote code execution due to improper handling of authentication requests in the Protected Extensible Authentication Protocol (PEAP), enabling attackers to execute harmful code without authentication.

What to do

An attacker could exploit this vulnerability to execute arbitrary code on affected systems, potentially gaining complete control over the network. This means they could access sensitive data, install malware, or disrupt critical services. It’s absolutely devastating if left unaddressed! Immediately apply the latest security patch from Microsoft to address this vulnerability. Ensure that all systems utilizing PEAP are updated and conduct a thorough audit of authentication methods to enhance security. Don't delay! You've got this! By following these steps, you'll safeguard your systems from this serious threat! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
9.8 Β· CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.21403 Β· 97.6th percentile
Weakness
CWE-122 Β· Heap-based Buffer Overflow
Published
2023-02-15T01:15Z
Affected products (28)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1974710.0.10240.19747
microsoft/windows_10_1507< 10.0.10240.1974710.0.10240.19747
microsoft/windows_10_1607< 10.0.14393.571710.0.14393.5717
microsoft/windows_10_1607< 10.0.14393.571710.0.14393.5717
microsoft/windows_10_1809< 10.0.17763.401010.0.17763.4010
microsoft/windows_10_1809< 10.0.17763.401010.0.17763.4010
microsoft/windows_10_1809< 10.0.17763.401010.0.17763.4010
microsoft/windows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoft/windows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoft/windows_10_20h2< 10.0.19042.260410.0.19042.2604
microsoft/windows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoft/windows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoft/windows_10_21h2< 10.0.19044.260410.0.19044.2604
microsoft/windows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoft/windows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoft/windows_10_22h2< 10.0.19045.260410.0.19045.2604
microsoft/windows_11_21h2< 10.0.22000.157410.0.22000.1574
microsoft/windows_11_21h2< 10.0.22000.157410.0.22000.1574
microsoft/windows_11_22h2< 10.0.22621.126510.0.22621.1265
microsoft/windows_11_22h2< 10.0.22621.126510.0.22621.1265
microsoft/windows_server_2008all versionsβ€”
microsoft/windows_server_2008all versionsβ€”
microsoft/windows_server_2008all versionsβ€”
microsoft/windows_server_2012all versionsβ€”
microsoft/windows_server_2012all versionsβ€”
microsoft/windows_server_2016all versionsβ€”
microsoft/windows_server_2019all versionsβ€”
microsoft/windows_server_2022all versionsβ€”
References (2)
EPSS history
Timeline
  • 14 FEB 19:33Z
    Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
    cvelistv5