Cyber Resilience

CVE-2023-21683

High

Published: 10 January 2023

Published
10 January 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.3428 97.1th percentile
Risk Priority 36 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-21683 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

Windows Internet Key Exchange (IKE) Extension contains a denial-of-service vulnerability tracked as CVE-2023-21683. The flaw, assigned CWE-476, affects the IKE component in Windows and carries a CVSS 3.1 base score of 7.5 reflecting a network-reachable availability impact without any confidentiality or integrity loss.

An unauthenticated remote attacker can send specially crafted network traffic to trigger the flaw, resulting in a denial-of-service condition against the IKE service. No user interaction or credentials are required, and the attack can be launched over the network with low complexity.

Microsoft has published remediation guidance for the issue in its Security Response Center update guide at the listed reference URL. The EPSS score for the CVE has reached 0.3428 with no material change from its recorded peak.

EU & UK References

Vulnerability details

Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows 10 1607
all versions
microsoft
windows 10 1809
all versions
microsoft
windows 10 20h2
all versions
microsoft
windows 10 21h2
all versions
microsoft
windows 10 22h2
all versions
microsoft
windows 11 21h2
all versions
microsoft
windows 11 22h2
all versions
microsoft
windows 8.1
all versions
microsoft
windows rt 8.1
all versions
microsoft
windows server 2012
all versions, r2
+3 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References