CVE-2024-43581
Published: 08 October 2024
Summary
CVE-2024-43581 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.1 (High).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft OpenSSH for Windows contains a remote code execution vulnerability identified as CVE-2024-43581. The flaw is associated with CWE-73 and carries a CVSS 3.1 base score of 7.1 reflecting a network attack vector, high attack complexity, low privileges required, and required user interaction.
An authenticated attacker positioned on the network can leverage the issue to execute arbitrary code on an affected system, resulting in high impact to confidentiality, integrity, and availability. Exploitation requires the victim user to perform specific actions, limiting the immediacy of successful attacks.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43581 supplies official details and remediation guidance. The associated EPSS score has remained flat at 0.0510 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40335
Vulnerability details
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Rejects externally supplied file or resource identifiers that fail validity checks.