CVE-2022-34721
Published: 13 September 2022
Summary
CVE-2022-34721 is a critical-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-34721 is a remote code execution vulnerability in the Windows Internet Key Exchange (IKE) Protocol Extensions. It affects multiple versions of Windows that implement IKE for IPsec VPN connections and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack conditions with no required privileges or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated attacker can send specially crafted IKE messages over the network to trigger the flaw, resulting in arbitrary code execution with the privileges of the IKE service and potential full system compromise.
Microsoft’s advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34721 directs administrators to install the security updates released on 13 September 2022 for the affected Windows releases; no workarounds are listed as sufficient.
The EPSS score reached a peak of 0.2748 and currently stands at 0.2660, indicating sustained moderate exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-37670
Vulnerability details
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.