cbcvebase.
CVE-2021-24086
published 2021-02-25

CVE-2021-24086: Windows TCP/IP Denial of Service Vulnerability Windows TCP/IP Denial of Service Vulnerability

high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
58.96%
99.0th percentile
Windows TCP/IP Denial of Service Vulnerability Windows TCP/IP Denial of Service Vulnerability

Affected

35 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_version_1507>= 10.0.0 < publicationpublication
microsoftwindows_10_version_1607>= 10.0.0 < publicationpublication
microsoftwindows_10_version_1803>= 10.0.0 < publicationpublication
microsoftwindows_10_version_1809>= 10.0.0 < publicationpublication
microsoftwindows_10_version_1909>= 10.0.0 < publicationpublication
microsoftwindows_10_version_2004>= 10.0.0 < publicationpublication
microsoftwindows_10_version_20h2>= 10.0.0 < publicationpublication
microsoftwindows_7>= 6.1.0 < publicationpublication
microsoftwindows_7_service_pack_1>= 6.1.0 < publicationpublication
microsoftwindows_8.1>= 6.3.0 < publicationpublication
microsoftwindows_server_2008_r2_service_pack_1>= 6.0.0 < publicationpublication
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.0 < publicationpublication
microsoftwindows_server_2008_service_pack_2>= 6.0.0 < publicationpublication
microsoftwindows_server_2012>= 6.2.0 < publicationpublication
microsoftwindows_server_2012_r2>= 6.3.0 < publicationpublication
microsoftwindows_server_2016>= 10.0.0 < publicationpublication
microsoftwindows_server_2019>= 10.0.0 < publicationpublication
microsoftwindows_server_version_2004>= 10.0.0 < publicationpublication
microsoftwindows_server_version_20h2>= 10.0.0 < publicationpublication
msrcwindows_10
msrcwindows_10_version_1607
msrcwindows_10_version_1803
msrcwindows_10_version_1809
msrcwindows_10_version_1909
msrcwindows_10_version_2004

Detection & IOCsextracted from sources · hover to see the quote

commandnetsh int ipv6 set global reassemblylimit=0
  • Detect crafted IPv6 packets with multiple headers, invalid headers, or multiple fragment headers targeting Windows TCP/IP stack — these are the attack vectors for CVE-2021-24086 DoS.
  • Monitor for IPv6 packets dropped due to truncated packets, invalid routing header position, or multiple fragment headers — these counters indicate active exploitation attempts against CVE-2021-24086.
  • Alert on IPv6 fragmentation reassembly activity on Windows hosts — CVE-2021-24086 is triggered via IPv6 fragmentation bugs; disabling reassembly (reassemblylimit=0) is the workaround.
  • Use edge/perimeter devices (not host-based firewalls) to block IPv6 fragmented packets — host-based firewalls are explicitly noted as insufficient protection for CVE-2021-24086.
  • Scope exposure: Windows systems configured with ONLY IPv6 link-local addresses are not reachable by remote attackers for CVE-2021-24086 — focus monitoring on systems with routable IPv6 addresses.
  • ·The workaround command sets IPv6 reassembly limit to 0, dropping all out-of-order IPv6 fragments — this may cause legitimate packet loss and should be tested before deploying to production.
  • ·The default reassembly limit is 267748640; restoring it after patching requires running: Netsh int ipv6 set global reassemblylimit=267748640

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
cvelistv57.5HIGH
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.