CVE-2019-0688 — Use of a Broken or Risky Cryptographic Algorithm in Microsoft Windows

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm15 documents7 sources

Severity

7.5HIGHNVD

EPSS

6.9%

top 8.60%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Windows Microsoft Windows Server Microsoft Windows 10 +16 more

Timeline

PublishedApr 9

Latest updateMay 13

Description

An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP Information Disclosure Vulnerability'.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages18 packages

▶msrcmsrc/windows_10

▶msrcmsrc/windows_8.1

▶CVEListV5microsoft/windows18 versions+17

▶NVDmicrosoft/windowsr2, 1709, 1803+2

▶msrcmsrc/windows_rt_8.1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-m3c3-22wf-38mv: An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP Information↗2022-05-13

▶

💥Exploits & PoCs

Exploit-DB

Microsoft Exchange 2019 15.2.221.12 - Authenticated Remote Code Execution↗2020-03-02

▶

📋Vendor Advisories

Microsoft

Windows TCP/IP Information Disclosure Vulnerability↗2019-04-09

▶