Skip to content
OpenAdvisories
Critical MSRC-CVE-2023-21712 1 CVE

Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

Published Jan 10, 2023 · Updated Jan 27, 2023 · Revision 2

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.

How could an attacker exploit this vulnerability?
An unauthenticated attacker could send a specially crafted protocol message to a Routing and Remote Access Service (RRAS) server, which could lead to remote code execution (RCE) on the RAS server machine.

Security updates
10.0.17763.3650 — https://support.microsoft.com/help/5019966
10.0.19043.2251 — https://support.microsoft.com/help/5019959
10.0.20348.1249 — https://support.microsoft.com/help/5019081
10.0.20348.1251 — https://support.microsoft.com/help/5019080
10.0.22000.1219 — https://support.microsoft.com/help/5019961
10.0.22621.819 — https://support.microsoft.com/help/5019980
10.0.19045.2486 — https://support.microsoft.com/help/5022282
10.0.10240.19562 — https://support.microsoft.com/help/5019970
10.0.14393.5501 — https://support.microsoft.com/help/5019964
6.3.9600.20671 — https://support.microsoft.com/help/5020023
6.3.9600.20670 — https://support.microsoft.com/help/5020010
6.2.9200.23968 — https://support.microsoft.com/help/5020009
6.2.9200.23968 — https://support.microsoft.com/help/5020003

Vulnerabilities 1

Revision history

  1. #2

    Fixed some incorrect KB numbers. This is an information change only.

  2. #1

    Information published. This CVE was addressed by updates that were released in November 2022, but the CVE was inadvertently omitted from the November 2022 Security Updates. This is an informational change only. Customers who have already installed the November 2022 updates do not need to take any further action.

References