CVE-2022-35748
Published: 31 May 2023
Summary
CVE-2022-35748 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35748 is a denial-of-service vulnerability in HTTP.sys, the kernel-mode HTTP protocol stack driver used by Internet Information Services (IIS) and other Windows components that handle HTTP traffic. The flaw received a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with high impact solely on availability.
An unauthenticated remote attacker can send specially crafted HTTP requests to a vulnerable system and trigger the condition that causes the affected service or the entire system to stop responding, producing a denial-of-service outcome without any data disclosure or modification.
Microsoft’s security advisory for CVE-2022-35748 directs administrators to install the vendor-supplied security updates, which address the issue in supported Windows releases; no additional configuration changes or workarounds are specified in the primary reference.
The CVE carries an EPSS score that has reached approximately 0.48, indicating substantial exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38621
Vulnerability details
HTTP.sys Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.