CVE-2023-35366CWE-20

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Critical · published July 11, 2023

CVSS v3.1
9.8
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

🚨 A remote code execution vulnerability in Windows RRAS is like leaving a backdoor wide open for anyone to stroll right in! 🔥 Think of RRAS as a delivery service that allows data to travel efficiently. If there's a crack in their system, it's like a delivery truck that lets anyone jump in and hijack the cargo — in this case, sensitive data and system control! An attacker who successfully exploits this vulnerability could gain full system access, allowing them to execute malicious commands, modify system configurations, and potentially wreak havoc on your network. The consequences could be absolutely devastating, jeopardizing sensitive data and putting your entire infrastructure at risk!

Put simply

Think of RRAS as a delivery service that allows data to travel efficiently. If there's a crack in their system, it's like a delivery truck that lets anyone jump in and hijack the cargo — in this case, sensitive data and system control! This vulnerability exists due to improper handling of requests by the Windows Routing and Remote Access Service (RRAS), which can be exploited to run arbitrary code remotely without authentication.

What to do

An attacker who successfully exploits this vulnerability could gain full system access, allowing them to execute malicious commands, modify system configurations, and potentially wreak havoc on your network. The consequences could be absolutely devastating, jeopardizing sensitive data and putting your entire infrastructure at risk! To mitigate this risk, immediately apply patches released by Microsoft for versions affected by this vulnerability. Additionally, review your network settings and limit access to RRAS services to trusted users only. It's crucial to stay vigilant and monitor access logs for any unusual activity. You've got this! Stay proactive and secure your systems — your hero status is just a patch away! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01689 · 76.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-07-11T17:03Z
EPSS history
Timeline
  • 11 JUL 17:03Z
    Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
    cvelistv5