MSRC-CVE-2023-23392 — HTTP Protocol Stack Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets.

Security updates
10.0.20348.1607 — https://support.microsoft.com/help/5023705
10.0.20348.1602 — https://support.microsoft.com/help/5023786
10.0.22000.1696 — https://support.microsoft.com/help/5023698
10.0.22621.1413 — https://support.microsoft.com/help/5023706

Vulnerabilities 1

Critical 9.8

CVE-2023-23392

HTTP Protocol Stack Remote Code Execution Vulnerability

HTTP Protocol Stack Remote Code Execution Vulnerability

Microsoft Windows Server 2022 Windows 11 version 22H2 Windows 11 version 21H2 Windows

Mar 14, 2023

Revision history

2023-03-14 #1
Information published.

References

CVE-2023-23392 HTTP Protocol Stack Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23392
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss