CVE-2023-23405

Deeper analysis

CVE-2023-23405 is a remote code execution vulnerability in the Remote Procedure Call Runtime component. It carries a CVSS 3.1 base score of 8.1 with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and is associated with CWE-190. The flaw was published on 14 March 2023 and affects Microsoft Windows systems that expose RPC functionality.

An unauthenticated remote attacker can trigger the issue over the network without user interaction, although successful exploitation requires high attack complexity. If successful, the attacker can execute arbitrary code with the privileges of the RPC service, resulting in full compromise of confidentiality, integrity, and availability on the target system.

Microsoft’s Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23405 provides official guidance and links to security updates that address the vulnerability. The current and peak EPSS scores both stand at 0.0507, indicating limited observed exploitation interest since disclosure.