CVE-2018-8612

CWE-20 — Improper Input Validation4 documents4 sources
Severity
5.5MEDIUM
EPSS
0.4%
top 42.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft Windows 10Microsoft Windows 10 ServersMicrosoft Windows Server 2016+1 more
Timeline
PublishedDec 12
Latest updateMay 14

Description

A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values, aka "Connected User Experiences and Telemetry Service Denial of Service Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5microsoft/windows_10_serversversion 1709 (Server Core Installation), version 1803 (Server Core Installation)+1
▶CVEListV5microsoft/windows_server_2016(Server Core installation)
▶CVEListV5microsoft/windows_server_2019(Server Core installation)
▶NVDmicrosoft/windows1709, 1803+1
▶CVEListV5microsoft/windows_1013 versions+12

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-cqg6-36p8-qxg8: A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values, aka "Connect↗2022-05-14
▶
CVEList
CVE-2018-8612: A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values, aka "Connect↗2018-12-12
▶

📋Vendor Advisories

1
Microsoft
Connected User Experiences and Telemetry Service Denial of Service Vulnerability↗2018-12-11
▶