CVE-2023-24939
Published: 09 May 2023
Summary
CVE-2023-24939 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-24939 is a denial of service vulnerability in the Server for NFS component. It was published on 2023-05-09 and carries a CVSS 3.1 base score of 7.5 reflecting a network attack vector with low complexity, no required privileges or user interaction, and high impact on availability.
An unauthenticated remote attacker can send crafted traffic to trigger the flaw and disrupt NFS service operation, resulting in a complete loss of availability for affected systems without any effect on confidentiality or integrity.
Microsoft publishes remediation guidance and patches for the issue through its Security Response Center update guide at the listed references. The associated EPSS score has remained flat at a peak of 0.1284 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28926
Vulnerability details
Server for NFS Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.