CVE-2023-21803
Published: 14 February 2023
Summary
CVE-2023-21803 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Microsoft Windows 10. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-21803 is a remote code execution vulnerability in the Windows iSCSI Discovery Service. It received a CVSS v3.1 score of 9.8 and is associated with CWE-190 integer overflow or wraparound. The flaw affects the iSCSI component responsible for discovery operations in Windows environments.
Unauthenticated attackers can exploit the issue over the network without user interaction or credentials, achieving full control over confidentiality, integrity, and availability on affected systems. The EPSS score has remained steady at 0.1393 with no material increase after disclosure. Microsoft has published guidance at the listed MSRC URLs.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-25970
Vulnerability details
Windows iSCSI Discovery Service Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.