CVE-2023-21677
Microsoft Windows 10 1809
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2023-21677 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 21% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Windows Internet Key Exchange (IKE) Extension contains a denial-of-service vulnerability tracked as CVE-2023-21677. The flaw affects the IKE component in Windows and carries a CVSS 3.1 score of 7.5, reflecting network attack vector, low complexity, and no required privileges or user interaction, with high impact on availability and no impact on confidentiality or integrity. The associated weakness is listed under CWE-822.
An unauthenticated remote attacker can send specially crafted network traffic to a vulnerable Windows system and trigger the IKE Extension to stop responding, resulting in a denial-of-service condition. Because the attack requires no authentication or user interaction and can be launched over the network, any reachable Windows host running the affected IKE implementation is potentially exposed.
Microsoft has published an advisory at the MSRC update guide for CVE-2023-21677 that addresses the issue. The current and peak EPSS scores both stand at 0.1645, indicating moderate but stable exploitation probability without a notable post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25844
Vulnerability Data
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent introduction of untrusted pointer handling during development.
Runtime monitoring of software and data can detect adverse events resulting from exploitation of the weakness.
Vulnerability identification processes can discover instances of this weakness via code review or scanning.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect pointer-dereference flaws before release.
Secure development lifecycle includes pointer-safety practices that reduce untrusted pointer dereference risk.
Application security requirements can mandate validation of pointers obtained from untrusted sources.
Secure architecture principles discourage direct use of untrusted values as pointers.
Secure coding standards explicitly forbid dereferencing pointers derived from untrusted input.