CVE-2022-35830
Published: 13 September 2022
Summary
CVE-2022-35830 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-35830 is a remote code execution vulnerability in the Remote Procedure Call Runtime component. It carries a CVSS 3.1 score of 8.1 with a vector indicating network attack vector, high attack complexity, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.
An unauthenticated attacker can exploit the flaw over the network to execute arbitrary code on affected systems, although the high complexity requirement raises the bar for reliable exploitation.
The referenced Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35830 supplies patch information and guidance for remediation.
EPSS remains flat at a peak and current value of 0.0599 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38703
Vulnerability details
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.