cbcvebase.
CVE-2022-34722
published 2022-09-13

CVE-2022-34722: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.22%
80.7th percentile
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

Affected

41 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.1944410.0.10240.19444
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.535610.0.14393.5356
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.340610.0.17763.3406
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.340610.0.17763.3406
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.200610.0.19042.2006
microsoftwindows_10_version_21h1>= 10.0.0 < 10.0.19043.200610.0.19043.2006
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.200610.0.19044.2006
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.97810.0.22000.978
microsoftwindows_7>= 6.1.0 < 6.1.7601.261156.1.7601.26115
microsoftwindows_7_service_pack_1>= 6.1.0 < 6.1.7601.261156.1.7601.26115
microsoftwindows_8.1>= 6.3.0 < 6.3.9600.205716.3.9600.20571
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.261156.1.7601.26115
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.216666.0.6003.21666
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.238656.2.9200.23865
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.205716.3.9600.20571
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.535610.0.14393.5356
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.340610.0.17763.3406
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.100610.0.20348.1006

Detection & IOCsextracted from sources · hover to see the quote

  • Target machines must have IPSec enabled to be exploitable; detection should focus on anomalous IKEv1 traffic (UDP 500/4500) sent to Windows hosts with IPSec enabled
  • Only IKEv1 packets are the attack vector; monitor for unexpected or malformed IKEv1 negotiation packets directed at Windows Servers, as all Windows Servers accept both V1 and V2 packets making them all exposed
  • The attack is unauthenticated and network-based (no credentials or prior access required); prioritize perimeter detection for crafted IP/IKEv1 packets targeting Windows endpoints
  • ·All Windows Servers are in scope regardless of explicit IKEv1 configuration, because they accept both IKEv1 and IKEv2 packets by default
  • ·Exploitation requires IPSec to be enabled on the target; systems without IPSec enabled are not directly exploitable via this vector

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.