CVE-2023-21757
Published: 10 January 2023
Summary
CVE-2023-21757 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows 10. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Layer 2 Tunneling Protocol (L2TP) in affected Windows versions contains a denial-of-service vulnerability tracked as CVE-2023-21757. The flaw, assigned CVSS 7.5 and linked to CWE-476, allows an unauthenticated network attacker to trigger a crash that renders the L2TP service unavailable while leaving confidentiality and integrity unaffected.
An adversary positioned on the network can send specially crafted L2TP traffic to exploit the issue without credentials or user interaction. Successful exploitation results in a high-impact availability condition that disrupts VPN connectivity for users relying on the protocol.
Microsoft’s Security Response Center advisory at the referenced URL supplies the official patch and any interim configuration guidance for administrators.
EPSS for the CVE reached a peak of 0.2395 after disclosure before settling at the current value of 0.1911, indicating measurable post-release exploitation interest that warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25924
Vulnerability details
Windows Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.