CVE-2022-37959
Published: 13 September 2022
Summary
CVE-2022-37959 is a medium-severity an unspecified weakness vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 5.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-37959 is a security feature bypass vulnerability in the Network Device Enrollment Service (NDES). The affected component is NDES, which is part of Active Directory Certificate Services on Windows Server. It carries a CVSS 3.1 score of 6.5 with a vector indicating network attack vector, low attack complexity, low privileges required, and high impact on confidentiality.
An authenticated attacker with low privileges can exploit the flaw over the network to bypass NDES security controls and access sensitive certificate enrollment data or related information, without user interaction.
Microsoft has published official guidance for the issue at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37959, directing administrators to the relevant security updates and configuration mitigations.
The associated EPSS score has remained flat at a peak of 0.1606 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-40566
Vulnerability details
Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.