CVE-2022-34724
Published: 13 September 2022
Summary
CVE-2022-34724 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows DNS Server is affected by CVE-2022-34724, a denial-of-service vulnerability that permits remote attackers to disrupt service availability. The flaw carries a CVSS 3.1 base score of 7.5 with network attack vector, low complexity, and no required privileges or user interaction, resulting in a high impact on availability while leaving confidentiality and integrity untouched.
An unauthenticated attacker with network access can send specially crafted queries to a vulnerable Windows DNS server, triggering a crash or resource exhaustion that renders the service unavailable. Because the attack requires no authentication or user interaction, it can be launched from anywhere on the network reachable by the DNS listener.
Microsoft’s security advisory at msrc.microsoft.com directs administrators to apply the updates released for the affected Windows versions; the bulletin lists the specific KB articles that contain the fix and notes that no configuration changes are required beyond installing the patch. The EPSS score has remained flat at 0.1932 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-37673
Vulnerability details
Windows DNS Server Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.