CVE-2023-21527

Deeper analysis

Windows iSCSI Service contains a denial-of-service vulnerability tracked as CVE-2023-21527. The flaw is present in the Windows iSCSI service and carries a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with high impact on availability and no impact on confidentiality or integrity. The associated weakness identifiers are CWE-191 and NVD-CWE-noinfo.

An unauthenticated remote attacker can send specially crafted network traffic to an affected system and trigger the denial-of-service condition, rendering the iSCSI service unavailable. Because the attack requires no authentication or user interaction, it can be launched from anywhere on the network that can reach the target service.

Microsoft has published guidance for the issue at the Microsoft Security Response Center advisory page for CVE-2023-21527. The EPSS score for this CVE has remained flat at a peak of 0.2821 since disclosure, indicating no material increase in observed exploitation interest.