CVE-2022-41056
Published: 09 November 2022
Summary
CVE-2022-41056 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Network Policy Server (NPS) in Windows Server contains a denial-of-service vulnerability in its RADIUS protocol implementation, tracked as CVE-2022-41056. The flaw received a CVSS 3.1 score of 7.5 and is exploitable remotely over the network without authentication or user interaction, resulting in high impact to availability while leaving confidentiality and integrity unaffected.
An unauthenticated attacker can send specially crafted RADIUS messages to an exposed NPS server, triggering a crash or resource exhaustion that disrupts authentication services for VPN, wireless, or other network access scenarios. Because the attack requires no privileges, any reachable NPS instance is potentially affected.
Microsoft’s security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41056 provides patch information and mitigation guidance for supported Windows Server versions. The associated EPSS score has remained at 0.2291 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-44301
Vulnerability details
Network Policy Server (NPS) RADIUS Protocol Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.