Cyber Resilience

CVE-2023-24939

High

Published: 09 May 2023

Published
09 May 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.1284 94.2th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-24939 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2023-24939 is a denial of service vulnerability in the Server for NFS component. It was published on 2023-05-09 and carries a CVSS 3.1 base score of 7.5 reflecting a network attack vector with low complexity, no required privileges or user interaction, and high impact on availability.

An unauthenticated remote attacker can send crafted traffic to trigger the flaw and disrupt NFS service operation, resulting in a complete loss of availability for affected systems without any effect on confidentiality or integrity.

Microsoft publishes remediation guidance and patches for the issue through its Security Response Center update guide at the listed references. The associated EPSS score has remained flat at a peak of 0.1284 with no material increase observed after disclosure.

EU & UK References

Vulnerability details

Server for NFS Denial of Service Vulnerability

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows 10 1507
≤ 10.0.10240.19926
microsoft
windows 10 1607
≤ 10.0.14393.5921
microsoft
windows 10 1809
≤ 10.0.17763.4377
microsoft
windows 10 20h2
≤ 10.0.19042.2965
microsoft
windows 10 21h2
≤ 10.0.19044.2965
microsoft
windows 10 22h2
≤ 10.0.19045.2965
microsoft
windows 11 21h2
≤ 10.0.22000.1936
microsoft
windows 11 22h2
≤ 10.0.22000.1702
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
all versions
+2 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References