CVE-2022-21843
Published: 11 January 2022
Summary
CVE-2022-21843 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Internet Key Exchange (IKE) Protocol Extensions contain a remote code execution vulnerability tracked as CVE-2022-21843. The flaw affects the IKE component in Windows and carries a CVSS 3.1 score of 7.5 with a vector indicating network attackability, low complexity, and no required privileges or user interaction, resulting in a high availability impact.
An unauthenticated remote attacker can send specially crafted network traffic to trigger the vulnerability, leading to denial-of-service conditions on affected systems. The absence of confidentiality or integrity impact in the provided scoring limits the immediate outcome to service disruption rather than arbitrary code execution in practice.
Microsoft has published security guidance and an advisory for CVE-2022-21843 that detail available patches and mitigation steps for supported Windows versions. The EPSS score has remained flat at a peak of 0.1648 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26999
Vulnerability details
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.