CVE-2022-23253
Published: 09 March 2022
Summary
CVE-2022-23253 is a medium-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-23253 is a denial of service vulnerability affecting the Windows Point-to-Point Tunneling Protocol component. It carries a CVSS 3.1 base score of 6.5 with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating that the flaw can be triggered remotely under low attack complexity by an authenticated user and results in high impact to availability.
An attacker with low privileges who can reach the affected system over the network may exploit the vulnerability to disrupt service availability. The attack does not require user interaction and leaves confidentiality and integrity unaffected.
Microsoft publishes remediation guidance for CVE-2022-23253 in its Security Response Center update guide at the listed reference URL. The current and peak EPSS scores are both 0.3021, indicating no material post-disclosure rise in observed exploitation probability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28340
Vulnerability details
Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.