CVE-2024-38128
Integer Overflow or Wraparound (CWE-190)
Summary
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability. This vulnerability affects the Windows Routing and Remote Access Service, allowing potential remote code execution. It has a CVSS v3 base score of 8.8, indicating a high severity level. The vulnerability requires user interaction and can be exploited over the network without needing any privileges.
Impact
If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code on the target system with high impact on confidentiality, integrity, and availability. The attacker could potentially gain the same level of access as the compromised user, which could lead to unauthorized access to sensitive information, modification of system files, or disruption of services. Given the nature of RRAS, which is often used in network infrastructure, a successful attack could have far-reaching consequences on network operations and security.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft has released an official fix for this vulnerability on August 13, 2024. Security teams should prioritize applying this patch to affected systems.
Mitigation
1. Apply the official patch released by Microsoft as soon as possible. 2. Implement network segmentation to limit the exposure of RRAS services. 3. Ensure that RRAS is not unnecessarily exposed to untrusted networks. 4. Educate users about the risks of interacting with untrusted content, as the vulnerability requires user interaction. 5. Monitor RRAS-related activities and logs for any suspicious behavior. 6. Implement the principle of least privilege for users who interact with RRAS. 7. Keep all Windows systems and RRAS components up to date with the latest security updates.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Timeline
Detection for the vulnerability has been added to Qualys (92160)
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-38128. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-38128
EPSS Score was set to: 0.15% (Percentile: 52.3%)