CVE-2023-21683
Published: 10 January 2023
Summary
CVE-2023-21683 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Internet Key Exchange (IKE) Extension contains a denial-of-service vulnerability tracked as CVE-2023-21683. The flaw, assigned CWE-476, affects the IKE component in Windows and carries a CVSS 3.1 base score of 7.5 reflecting a network-reachable availability impact without any confidentiality or integrity loss.
An unauthenticated remote attacker can send specially crafted network traffic to trigger the flaw, resulting in a denial-of-service condition against the IKE service. No user interaction or credentials are required, and the attack can be launched over the network with low complexity.
Microsoft has published remediation guidance for the issue in its Security Response Center update guide at the listed reference URL. The EPSS score for the CVE has reached 0.3428 with no material change from its recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25850
Vulnerability details
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.