CVE-2023-35365CWE-20

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Critical · published July 11, 2023

CVSS v3.1
9.8
EPSS
2%
Percentile
77.9
In the wild
Unconfirmed
What it is

🚨 A remote code execution vulnerability lurks in Windows RRAS, ready to be exploited by the determined mischief-maker! 🔥 Think of RRAS like a bustling airport control tower—if a stranger could sneak in and issue flight orders, chaos would ensue! This flaw allows attackers to take control just as easily, redirecting traffic at will. An attacker could gain full control of the system, potentially manipulating sensitive data, installing malicious software, or even launching further attacks across the network. The fallout could be absolutely devastating, leading to data breaches or loss of critical services.

Put simply

Think of RRAS like a bustling airport control tower—if a stranger could sneak in and issue flight orders, chaos would ensue! This flaw allows attackers to take control just as easily, redirecting traffic at will. The vulnerability arises from improper handling of requests within RRAS, allowing an attacker to execute arbitrary code with SYSTEM privileges. This essentially opens a backdoor for unauthorized access and control of the system.

What to do

An attacker could gain full control of the system, potentially manipulating sensitive data, installing malicious software, or even launching further attacks across the network. The fallout could be absolutely devastating, leading to data breaches or loss of critical services. Immediate patching is crucial—update to the latest security patch provided by Microsoft for Windows RRAS. Additionally, review your network access controls and apply best practices to minimize exposure. Don't wait! You've got this! Fixing this vulnerability now will secure your network like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01768 · 77.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-07-11T17:03Z
EPSS history
Timeline
  • 11 JUL 17:03Z
    Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
    cvelistv5