CVE-2024-30010

Deeper analysis

CVE-2024-30010 is a remote code execution vulnerability affecting the Windows Hyper-V component. It carries a CVSS 3.1 base score of 8.8 with an attack vector of network, low attack complexity, low privileges required, and no user interaction, resulting in high impact to confidentiality, integrity, and availability. The weakness is associated with CWE-23.

An authenticated attacker with low privileges can exploit the flaw over a network connection to execute arbitrary code on a vulnerable Hyper-V host. Successful exploitation grants the attacker full control equivalent to the compromised process privileges, enabling actions such as installing programs, viewing or modifying data, or creating new accounts.

Microsoft security advisories published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30010 detail the available patches and mitigation steps for affected Windows versions.

The associated EPSS score has remained flat at 0.1040 with no material rise observed since disclosure.