CVE-2023-28234

Deeper analysis

Windows Secure Channel in affected versions of Microsoft Windows is subject to a denial of service vulnerability tracked as CVE-2023-28234. The flaw received a CVSS 3.1 base score of 7.5, reflecting a network-accessible attack that requires no authentication or user interaction and produces a high impact on availability while leaving confidentiality and integrity untouched.

An unauthenticated remote attacker can send specially crafted network traffic to a vulnerable system and trigger the denial-of-service condition, causing the Secure Channel component to stop responding or crash. Because the attack requires no privileges or user assistance, it can be launched from anywhere on the network that can reach the target service.

Microsoft security advisories published at the referenced MSRC update guide URL describe the affected platforms and supply the corresponding security updates that address the issue. The EPSS score for this CVE has remained flat at 0.1470 since disclosure, indicating no material increase in observed exploitation activity.