CVE-2022-41097
Published: 09 November 2022
Summary
CVE-2022-41097 is a medium-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 3.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-41097 is an information disclosure vulnerability in the Network Policy Server (NPS) component of Windows Server that implements the RADIUS protocol. The flaw received a CVSS v3.1 score of 6.5 and is tracked under NVD-CWE-noinfo, indicating insufficient detail was available at publication to assign a more specific weakness category.
An attacker with low-privileged network access and no user interaction required can exploit the issue to obtain sensitive information from the RADIUS service. The attack vector is rated as network-accessible with low complexity, resulting in high impact to confidentiality while leaving integrity and availability unaffected.
Microsoft has published guidance for the vulnerability at its Security Response Center pages. The current EPSS score of 0.2401, which also represents the observed peak, indicates moderate and sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-44340
Vulnerability details
Network Policy Server (NPS) RADIUS Protocol Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.