Cyber Resilience

CVE-2022-21984

High

Published: 09 February 2022

Published
09 February 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0746 92.0th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-21984 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2022-21984 is a remote code execution vulnerability affecting the Windows DNS Server component. It was assigned a CVSS 3.1 base score of 8.8 reflecting network attack vector, low attack complexity, low privileges required, and no user interaction, with high impact on confidentiality, integrity, and availability.

An authenticated attacker with network access can exploit the flaw to achieve remote code execution on the target DNS server, resulting in full compromise of the affected system.

Microsoft Security Response Center advisories for CVE-2022-21984 direct administrators to apply the patches released in the corresponding security update. The EPSS score shows a flat trajectory with both current and peak values at 0.0746 and no material rise after disclosure.

EU & UK References

Vulnerability details

Windows DNS Server Remote Code Execution Vulnerability

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows 10
1909, 20h2, 21h1, 21h2
microsoft
windows 11
all versions
microsoft
windows server
2022, 20h2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References