CVE-2023-21689

Deeper analysis

Microsoft Protected Extensible Authentication Protocol (PEAP) contains a remote code execution vulnerability tracked as CVE-2023-21689. The flaw is present in the PEAP implementation used for network authentication in Microsoft Windows and related networking components. It received a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors with low complexity and no required privileges or user interaction, and is associated with CWE-122 (heap-based buffer overflow).

An unauthenticated attacker able to reach a vulnerable PEAP endpoint can send specially crafted authentication messages that trigger the flaw, resulting in arbitrary code execution on the target system with full control over confidentiality, integrity, and availability. The attack requires only network adjacency to the affected service and does not depend on user interaction or credentials.

Microsoft’s advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21689 provides the official patch and mitigation guidance. The current EPSS score of 0.2938 with a recorded peak of 0.3514 indicates moderate and sustained exploitation interest following disclosure.