cbcvebase.
CVE-2022-41047
published 2022-11-09

CVE-2022-41047: Microsoft ODBC Driver Remote Code Execution Vulnerability

PriorityP349high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.44%
70.1th percentile
Microsoft ODBC Driver Remote Code Execution Vulnerability

Affected

46 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.1956710.0.10240.19567
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.550110.0.14393.5501
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.365010.0.17763.3650
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.365010.0.17763.3650
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.225110.0.19042.2251
microsoftwindows_10_version_21h1>= 10.0.0 < 10.0.19043.225110.0.19043.2251
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.225110.0.19044.2251
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.225110.0.19045.2251
microsoftwindows_11
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.121910.0.22000.1219
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.81910.0.22621.819
microsoftwindows_7>= 6.1.0 < 6.1.7601.262216.1.7601.26221
microsoftwindows_7_service_pack_1>= 6.1.0 < 6.1.7601.262216.1.7601.26221
microsoftwindows_8.1>= 6.3.0 < 6.3.9600.206716.3.9600.20671
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.262216.1.7601.26221
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.217686.0.6003.21768
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.239686.2.9200.23968

Detection & IOCsextracted from sources · hover to see the quote

  • Attack vector requires a user to initiate an ODBC connection to a malicious SQL server; monitor for outbound SQL/ODBC connection attempts to untrusted or external hosts
  • The exploit is client-side RCE triggered by a malicious networking packet received during ODBC connection setup; inspect ODBC driver traffic for anomalous/oversized packets from SQL server responses
  • ·Customer action is required; patching alone is insufficient without user-awareness controls since the attack requires social engineering an authenticated user to connect to a malicious SQL server
  • ·As of advisory publication, the vulnerability had not been publicly disclosed or exploited in the wild, reducing immediate urgency but not eliminating risk

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.