CVE-2023-28240
published 2023-04-11CVE-2023-28240: Windows Network Load Balancing Remote Code Execution Vulnerability
PriorityP349high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.75%
50.9th percentile
Windows Network Load Balancing Remote Code Execution Vulnerability
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26466 | 6.1.7601.26466 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.22015 | 6.0.6003.22015 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24216 | 6.2.9200.24216 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20919 | 6.3.9600.20919 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.5850 | 10.0.14393.5850 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.4252 | 10.0.17763.4252 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.1668 | 10.0.20348.1668 |
| msrc | windows_server_2008_for_32-bit_systems_service_pack_2 | — | — |
| msrc | windows_server_2008_for_x64-based_systems_service_pack_2 | — | — |
| msrc | windows_server_2008_r2_for_x64-based_systems_service_pack_1 | — | — |
| msrc | windows_server_2012 | — | — |
| msrc | windows_server_2012_r2 | — | — |
| msrc | windows_server_2016 | — | — |
| msrc | windows_server_2019 | — | — |
| msrc | windows_server_2022 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Network Load Balancing Remote Code Execution Vulnerability
vendor_msrc·2023-04-11·CVSS 8.8
CVE-2023-28240 [HIGH] CWE-122 Windows Network Load Balancing Remote Code Execution Vulnerability
Windows Network Load Balancing Remote Code Execution Vulnerability
FAQ: How could an attacker exploit this vulnerability?
To exploit this vulnerability, an attacker on the same subnet as the target system would need to send a specially crafted packet to a server configured as a Network Load Balancing cluster host.
FAQ: According to the CVSS score, the attack vector is adjacent (AV:A). What does this mean for this vulnerability?
This attack is limited to systems connected to the same network segment as the attacker. The attack cannot be performed across multiple networks (for example, a WAN) and would be limited to systems on the same network switch or virtual network.
Windows Network Load Balancing: Windows Network Load Balancing
Microsoft: Microsoft
Customer Action Required: Yes
Imp
GHSA
GHSA-fg86-xg34-2fr5: Windows Network Load Balancing Remote Code Execution Vulnerability
ghsa_unreviewed·2023-04-11
CVE-2023-28240 [HIGH] GHSA-fg86-xg34-2fr5: Windows Network Load Balancing Remote Code Execution Vulnerability
Windows Network Load Balancing Remote Code Execution Vulnerability
No detection rules found.
No public exploits indexed.
Qualys
Microsoft and Adobe Patch Tuesday April 2023 Security Update Review | Qualys
blogs_qualys·2023-04-12
Microsoft and Adobe Patch Tuesday April 2023 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for April 2023
- Adobe Patches for April 2023
- Zero-day Vulnerability Patched in April Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in April Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- Qualys Monthly Webinar Series
- This Month in Vulnerabilities & Patches
Microsoft released security updates to address 114 vulnerabilities in the April Patch Tuesday edition. The security advisories co
Qualys
Microsoft and Adobe Patch Tuesday April 2023 Security Update Review
blogs_qualys·2023-04-12
Microsoft and Adobe Patch Tuesday April 2023 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for April 2023
Adobe Patches for April 2023
Zero-day Vulnerability Patched in April Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in April Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
Qualys Monthly Webinar Series
This Month in Vulnerabilities & Patches
Microsoft released security updates to address 114 vulnerabilities in the April Patch Tuesday edition. The security advisories cover various vul
Talos
Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-04-11·CVSS 7.8
CVE-2023-28252 [HIGH] Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly round of security updates and patches today, continuing its trend of fixing zero-day vulnerabilities on Patch Tuesday.
April's security update includes one vulnerability that’s actively being exploited in the wild. There are also eight critical vulnerabilities and the remaining 90 are considered “important.”
CVE-2023-28252 , an elevation of privilege vulnerability in the Windows Common Log File System Driver, is actively being exploited in the wild, according to Microsoft, though proof of concept code is not currently available. An adversary could exploit this vulnerability to gain SYSTEM privileges.
The U.S. Cybersecurity and Infrastructure Security Agency already added
Talos
Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-04-11·CVSS 7.8
CVE-2023-28252 [HIGH] Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly round of security updates and patches today, continuing its trend of fixing zero-day vulnerabilities on Patch Tuesday.
April's security update includes one vulnerability that’s actively being exploited in the wild. There are also eight critical vulnerabilities and the remaining 90 are considered “important.”
CVE-2023-28252, an elevation of privilege vulnerability in the Windows Common Log File System Driver, is actively being exploited in the wild, according to Microsoft, though proof of concept code is not currently available. An adversary could exploit this vulnerability to gain SYSTEM privileges.
The U.S. Cybersecurity and Infrastructure Security Agency already added the vulnerability to its list of know exploited issues and urged federal agencies to pa
2023-04-11
Published