CVE-2022-35744

Deeper analysis

Windows Point-to-Point Protocol (PPP) contains a remote code execution vulnerability tracked as CVE-2022-35744. The flaw resides in the Windows PPP implementation and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction and result in complete compromise of confidentiality, integrity, and availability.

An unauthenticated remote attacker can send specially crafted PPP packets to a vulnerable Windows system and achieve arbitrary code execution with the privileges of the affected process. Because the vulnerability can be reached over the network without credentials, it enables attackers to gain full control of the target host.

Microsoft’s security advisory at msrc.microsoft.com details the affected Windows versions and supplies the corresponding security updates that address the flaw. The EPSS score for this CVE has remained at 0.1549 from disclosure through the present, indicating steady but not sharply increasing exploitation interest.