CVE-2024-43592
Heap-based Buffer Overflow (CWE-122)
Summary
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability. This vulnerability allows an attacker with low privileges to execute arbitrary code remotely through the network, with no user interaction required. The attack complexity is low, indicating that it is relatively easy to exploit.
Impact
The impact of this vulnerability is severe. It can lead to a complete compromise of the confidentiality, integrity, and availability of the affected system. An attacker could potentially execute arbitrary code with the same privileges as the RRAS service, which typically runs with high system privileges. This could allow the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft has released an official fix for this vulnerability on October 8, 2024.
Mitigation
1. Apply the official patch released by Microsoft as soon as possible. 2. If immediate patching is not feasible, consider temporarily disabling the Windows Routing and Remote Access Service if it's not critical for operations. 3. Implement network segmentation to limit the exposure of systems running RRAS. 4. Monitor for unusual activity related to RRAS. 5. Ensure that only authorized users have low-privilege access to systems running RRAS. 6. Keep all Windows systems and software up to date with the latest security updates.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Timeline
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-43592. See article
Feedly estimated the CVSS score as HIGH
CVE-2024-43592 is a critical Remote Code Execution vulnerability in Windows Routing and Remote Access Service (RRAS) with a CVSSv3 score of 8.8, categorized as “Exploitation Less Likely” by Microsoft. Exploitation could occur by targeting a vulnerable server with specially crafted protocol messages, but there is no indication of active exploitation in the wild or available proof-of-concept exploits. Microsoft has not specified any mitigations, detections, or patches for this vulnerability, nor are there mentions of downstream impacts to third-party vendors or technology. See article
NVD published the first details for CVE-2024-43592
Detection for the vulnerability has been added to Nessus (208305)
Detection for the vulnerability has been added to Nessus (208298)
Detection for the vulnerability has been added to Nessus (208294)
Detection for the vulnerability has been added to Nessus (208289)