CVE-2022-23294
published 2022-03-09CVE-2022-23294: Windows Event Tracing Remote Code Execution Vulnerability
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.22%
80.7th percentile
Windows Event Tracing Remote Code Execution Vulnerability
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19235 | 10.0.10240.19235 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5006 | 10.0.14393.5006 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.2686 | 10.0.17763.2686 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.2686 | 10.0.17763.2686 |
| microsoft | windows_10_version_1909 | >= 10.0.0 < 10.0.18363.2158 | 10.0.18363.2158 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.1586 | 10.0.19042.1586 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.1586 | 10.0.19043.1586 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.1586 | 10.0.19044.1586 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.556 | 10.0.22000.556 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20303 | 6.3.9600.20303 |
| microsoft | windows_server | — | — |
| microsoft | windows_server | — | — |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.23645 | 6.2.9200.23645 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20303 | 6.3.9600.20303 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.5006 | 10.0.14393.5006 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.2686 | 10.0.17763.2686 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.587 | 10.0.20348.587 |
| microsoft | windows_server_version_20h2 | >= 10.0.0 < 10.0.19042.1586 | 10.0.19042.1586 |
Detection & IOCsextracted from sources · hover to see the quote
- →The attack vector targets the Event Log's Remote Procedure Call (RPC) endpoint on the server-side; monitor for unusual RPC calls to the Event Log service endpoint from authenticated low-privileged users. ↗
- →Monitor for firewall rule changes that expose the Event Log service RPC endpoint, as it is blocked by default and must be explicitly opened for remote exploitation. ↗
- ·The Event Log RPC endpoint is blocked by default; exploitation requires a deliberate firewall rule change to expose it. Ensure this default block is enforced and audit any rules that open this endpoint. ↗
- ·Any authenticated (low-privileged) user can trigger this vulnerability — no admin rights required. Scope detection to all authenticated user accounts, not just privileged ones. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r39c-fhw7-34q8: Windows Event Tracing Remote Code Execution Vulnerability
ghsa_unreviewed·2022-03-10
CVE-2022-23294 [HIGH] GHSA-r39c-fhw7-34q8: Windows Event Tracing Remote Code Execution Vulnerability
Windows Event Tracing Remote Code Execution Vulnerability.
Microsoft
Windows Event Tracing Remote Code Execution Vulnerability
vendor_msrc·2022-03-08·CVSS 8.8
CVE-2022-23294 [HIGH] Windows Event Tracing Remote Code Execution Vulnerability
Windows Event Tracing Remote Code Execution Vulnerability
FAQ: How can an attacker exploit this vulnerability?
An authenticated attacker could potentially take advantage of this vulnerability to execute malicious code through the Event Log's Remote Procedure Call (RPC) endpoint on the server-side.
FAQ: According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated user could trigger this vulnerability. It does not require admin or other elevated privileges.
FAQ: What is a Remote Procedure Call?
Remote Procedure Call (RPC) is a communication mechanism that allows computers to communicate with one another over a network. An RPC consists of a procedure identifier, parameters passed to the procedure, and a value returned to the
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-03-09
Published