CVE-2023-21677

Deeper analysis

Windows Internet Key Exchange (IKE) Extension contains a denial-of-service vulnerability tracked as CVE-2023-21677. The flaw affects the IKE component in Windows and carries a CVSS 3.1 score of 7.5, reflecting network attack vector, low complexity, and no required privileges or user interaction, with high impact on availability and no impact on confidentiality or integrity. The associated weakness is listed under CWE-822.

An unauthenticated remote attacker can send specially crafted network traffic to a vulnerable Windows system and trigger the IKE Extension to stop responding, resulting in a denial-of-service condition. Because the attack requires no authentication or user interaction and can be launched over the network, any reachable Windows host running the affected IKE implementation is potentially exposed.

Microsoft has published an advisory at the MSRC update guide for CVE-2023-21677 that addresses the issue. The current and peak EPSS scores both stand at 0.1645, indicating moderate but stable exploitation probability without a notable post-disclosure increase.