CVE-2022-21907
Published: 11 January 2022
Summary
CVE-2022-21907 is a critical-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-21907 is a remote code execution vulnerability in the HTTP Protocol Stack. It carries a CVSS 3.1 score of 9.8 and permits unauthenticated network attackers to achieve full confidentiality, integrity, and availability impact on affected systems.
An attacker can send specially crafted HTTP requests over the network to trigger the flaw without any user interaction or credentials, resulting in arbitrary code execution on the target host.
Microsoft security advisories and updates addressing the issue are published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21907 and https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21907, with additional technical details available via Packet Storm.
The associated EPSS score has remained near its peak value of 0.9194 with a current reading of 0.9189, indicating sustained high exploitation likelihood since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27063
Vulnerability details
HTTP Protocol Stack Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.