CVE-2022-23285
Published: 09 March 2022
Summary
CVE-2022-23285 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-23285 is a remote code execution vulnerability in the Remote Desktop Client, assigned a CVSS 3.1 base score of 8.8 with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue was published on 9 March 2022 and carries the CWE classification NVD-CWE-noinfo.
An attacker can exploit the flaw over the network without authentication, provided the victim performs a required user interaction such as connecting to a malicious endpoint; successful exploitation grants the attacker full control over confidentiality, integrity, and availability on the affected system.
Microsoft publishes mitigation and patch information for the vulnerability through its Security Response Center at the listed advisory URLs.
The EPSS probability reached a peak of 0.2127 on 2026-06-01 before receding to the current value of 0.1000.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28371
Vulnerability details
Remote Desktop Client Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.