CVE-2023-21549
Published: 10 January 2023
Summary
CVE-2023-21549 is a high-severity Improper Authorization (CWE-285) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-21549 is an elevation-of-privilege vulnerability in the Windows SMB Witness Service. The flaw is tracked under CWE-285 and CWE-269 and carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, and low privileges required. It affects supported Windows releases that implement the SMB Witness Service for failover clustering and continuous availability.
An authenticated attacker with low-privileged network access can exploit the issue to obtain SYSTEM-level privileges on the target host, resulting in full control over confidentiality, integrity, and availability without user interaction. The attack can be launched remotely against any reachable SMB Witness endpoint that accepts the attacker’s credentials.
Microsoft’s security update guide for CVE-2023-21549 lists the corresponding monthly security updates that address the vulnerability; administrators are advised to apply the patches for the affected Windows versions. The EPSS score has remained flat at 0.0906 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25716
Vulnerability details
Windows SMB Witness Service Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.
Ensures authorization decisions are always performed by a complete and analyzable reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.
Review helps detect improper privilege management by flagging unauthorized privilege changes or uses.