CVE-2022-24498
Published: 15 April 2022
Summary
CVE-2022-24498 is a medium-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 5.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an information disclosure issue in the Windows iSCSI Target Service, assigned CVE-2022-24498 with a CVSS 3.1 score of 6.5. It affects the iSCSI Target Service component on Windows systems and allows unauthorized exposure of sensitive data over the network.
An attacker with low privileges and network access can exploit the flaw without user interaction to obtain high-confidentiality information from the affected service. The attack vector requires authentication but no special conditions beyond standard low-privilege access.
Microsoft security advisories at the referenced MSRC pages provide official guidance on available patches and mitigations for the vulnerability. The associated EPSS score has remained flat at 0.1595 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29379
Vulnerability details
Windows iSCSI Target Service Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.