CVE-2023-35367CWE-20

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Critical · published July 11, 2023

CVSS v3.1
9.8
EPSS
2%
Percentile
76.9
In the wild
Unconfirmed
What it is

🚨 A remote code execution vulnerability in Windows RRAS could turn your network into a playground for attackers! 🔥 Imagine a mischievous delivery person who can enter any room in your office with just a fake ID. This vulnerability allows an attacker to slip past authentication and execute malicious code as if they were a trusted user. An attacker could gain control over the entire system, potentially leading to data theft, service disruption, or even total system compromise. This is absolutely devastating, as it puts sensitive information and the integrity of your entire network at risk.

Put simply

Imagine a mischievous delivery person who can enter any room in your office with just a fake ID. This vulnerability allows an attacker to slip past authentication and execute malicious code as if they were a trusted user. The vulnerability in Windows Routing and Remote Access Service (RRAS) enables remote code execution by improperly handling requests, allowing attackers to run arbitrary code on vulnerable systems without proper authorization.

What to do

An attacker could gain control over the entire system, potentially leading to data theft, service disruption, or even total system compromise. This is absolutely devastating, as it puts sensitive information and the integrity of your entire network at risk. Immediate patching is essential! Update your Windows systems to the latest version to address this vulnerability. Additionally, review your network access controls to ensure only trusted users can access RRAS functionality. You've got this! By taking swift action, you can fortify your defenses and keep your systems secure. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01689 · 76.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-07-11T17:03Z
EPSS history
Timeline
  • 11 JUL 17:03Z
    Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
    cvelistv5