CVE-2023-21758

published 2023-01-10

CVE-2023-21758: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Priority P3 52 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Affected

30 ranges · showing 25

Vendor	Product	Version range	Fixed in
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10_version_1507	>= 10.0.10240.0 < 10.0.10240.19685	10.0.10240.19685
microsoft	windows_10_version_1607	>= 10.0.14393.0 < 10.0.14393.5648	10.0.14393.5648
microsoft	windows_10_version_1809	>= 10.0.0 < 10.0.17763.3887	10.0.17763.3887
microsoft	windows_10_version_1809	>= 10.0.17763.0 < 10.0.17763.3887	10.0.17763.3887
microsoft	windows_10_version_20h2	>= 10.0.0 < 10.0.19042.2486	10.0.19042.2486
microsoft	windows_10_version_21h2	>= 10.0.19043.0 < 10.0.19044.2486	10.0.19044.2486
microsoft	windows_10_version_22h2	>= 10.0.19045.0 < 10.0.19045.2486	10.0.19045.2486
microsoft	windows_11	—	—
microsoft	windows_11	—	—
microsoft	windows_11_version_21h2	>= 10.0.0 < 10.0.22000.1455	10.0.22000.1455
microsoft	windows_11_version_22h2	>= 10.0.22621.0 < 10.0.22621.1105	10.0.22621.1105
microsoft	windows_server_2016	>= 10.0.14393.0 < 10.0.14393.5648	10.0.14393.5648
microsoft	windows_server_2019	>= 10.0.17763.0 < 10.0.17763.3887	10.0.17763.3887
microsoft	windows_server_2022	>= 10.0.20348.0 < 10.0.20348.1487	10.0.20348.1487
msrc	windows_10	—	—
msrc	windows_10_version_1607	—	—
msrc	windows_10_version_1809	—	—
msrc	windows_10_version_20h2	—	—
msrc	windows_10_version_21h2	—	—
msrc	windows_10_version_22h2	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerability affects the Windows Internet Key Exchange (IKE) Extension, meaning detection should focus on anomalous or malformed IKE traffic targeting Windows systems (typically UDP port 500 and UDP port 4500 for NAT-T). ↗
• → Customer action is required and exploitation is assessed as 'Less Likely' for both latest and older software releases, but the vulnerability is publicly disclosed — prioritize patching and monitoring IKE/IPsec service availability on exposed Windows endpoints. ↗
• → Impact is Denial of Service against the Windows IKE Extension component; monitor for unexpected crashes or restarts of the IKE/IPsec service (ikeext.dll / IKEEXT service) on Windows hosts. ↗

• · No exploit code, hashes, malicious domains/IPs, or specific attack payloads are disclosed in the available sources. Operational IOCs cannot be extracted from the provided documentation. ↗
• · Remediation references point to multiple KB updates (KB5022286, KB5022291, KB5022282, KB5022287, KB5022303, KB5022297, KB5022289) covering different Windows versions — ensure the correct KB is applied per OS version. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vendor_msrc 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476