Cyber Resilience

CVE-2024-43581

High

Published: 08 October 2024

Published
08 October 2024
Modified
16 October 2024
KEV Added
Patch
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0510 90.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-43581 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.1 (High).

Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

Microsoft OpenSSH for Windows contains a remote code execution vulnerability identified as CVE-2024-43581. The flaw is associated with CWE-73 and carries a CVSS 3.1 base score of 7.1 reflecting a network attack vector, high attack complexity, low privileges required, and required user interaction.

An authenticated attacker positioned on the network can leverage the issue to execute arbitrary code on an affected system, resulting in high impact to confidentiality, integrity, and availability. Exploitation requires the victim user to perform specific actions, limiting the immediacy of successful attacks.

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43581 supplies official details and remediation guidance. The associated EPSS score has remained flat at 0.0510 with no material increase observed since disclosure.

EU & UK References

Vulnerability details

Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows 10 1809
≤ 10.0.17763.6414 · ≤ 10.0.17763.6414
microsoft
windows 10 21h2
≤ 10.0.19044.5011 · ≤ 10.0.19044.5011 · ≤ 10.0.19044.5011
microsoft
windows 10 22h2
≤ 10.0.19045.5011 · ≤ 10.0.19045.5011 · ≤ 10.0.19045.5011
microsoft
windows 11 21h2
≤ 10.0.22000.3260 · ≤ 10.0.22000.3260
microsoft
windows 11 22h2
≤ 10.0.22621.4317 · ≤ 10.0.22621.4317
microsoft
windows 11 23h2
≤ 10.0.22631.4317 · ≤ 10.0.22631.4317
microsoft
windows 11 24h2
≤ 10.0.26100.2033 · ≤ 10.0.26100.2033
microsoft
windows server 2019
≤ 10.0.17763.6414
microsoft
windows server 2022
≤ 10.0.20348.2762
microsoft
windows server 2022 23h2
≤ 10.0.25398.1189

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-73

Rejects externally supplied file or resource identifiers that fail validity checks.

References