CVE-2022-23253

published 2022-03-09

CVE-2022-23253: Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability

Priority P3 42 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability

Affected

45 ranges · showing 25

Vendor	Product	Version range	Fixed in
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10_version_1507	>= 10.0.10240.0 < 10.0.10240.19235	10.0.10240.19235
microsoft	windows_10_version_1607	>= 10.0.14393.0 < 10.0.14393.5006	10.0.14393.5006
microsoft	windows_10_version_1809	>= 10.0.0 < 10.0.17763.2686	10.0.17763.2686
microsoft	windows_10_version_1809	>= 10.0.17763.0 < 10.0.17763.2686	10.0.17763.2686
microsoft	windows_10_version_1909	>= 10.0.0 < 10.0.18363.2158	10.0.18363.2158
microsoft	windows_10_version_20h2	>= 10.0.0 < 10.0.19042.1586	10.0.19042.1586
microsoft	windows_10_version_21h1	>= 10.0.0 < 10.0.19043.1586	10.0.19043.1586
microsoft	windows_10_version_21h2	>= 10.0.19043.0 < 10.0.19044.1586	10.0.19044.1586
microsoft	windows_11_version_21h2	>= 10.0.0 < 10.0.22000.556	10.0.22000.556
microsoft	windows_7	>= 6.1.0 < 6.1.7601.25898	6.1.7601.25898
microsoft	windows_7_service_pack_1	>= 6.1.0 < 6.1.7601.25898	6.1.7601.25898
microsoft	windows_8.1	>= 6.3.0 < 6.3.9600.20303	6.3.9600.20303
microsoft	windows_server	—	—
microsoft	windows_server	—	—
microsoft	windows_server_2008	—	—
microsoft	windows_server_2008_r2_service_pack_1	>= 6.1.7601.0 < 6.1.7601.25898	6.1.7601.25898
microsoft	windows_server_2012	—	—
microsoft	windows_server_2012	>= 6.2.9200.0 < 6.2.9200.23645	6.2.9200.23645
microsoft	windows_server_2012_r2	>= 6.3.9600.0 < 6.3.9600.20303	6.3.9600.20303

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerability affects the Windows Point-to-Point Tunneling Protocol (PPTP) service. Monitor for anomalous or malformed PPTP connection attempts targeting Windows VPN servers, particularly on TCP port 1723 (standard PPTP control port). ↗
• → Exploitation likelihood is rated 'More Likely' for both latest and older software releases, indicating active interest from threat actors. Prioritize detection of PPTP traffic anomalies on exposed Windows servers. ↗

• · Customer action is required to remediate this vulnerability; patching alone is not automatic. Verify patch deployment via the referenced KB articles. ↗
• · As of the advisory publication, the vulnerability had not been publicly disclosed or exploited in the wild, but exploitation is considered more likely for all supported release tracks. ↗

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:N/I:N/A:P

vendor_msrc 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.