cbcvebase.
CVE-2024-43572
published 2024-10-08

CVE-2024-43572: Microsoft Management Console Remote Code Execution Vulnerability

PriorityP184high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2024-10-29
Exploited in the wild
EPSS
66.57%
99.2th percentile
Microsoft Management Console Remote Code Execution Vulnerability

Affected

48 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.2079610.0.10240.20796
microsoftwindows_10_1607< 10.0.14393.742810.0.14393.7428
microsoftwindows_10_1809< 10.0.17763.641410.0.17763.6414
microsoftwindows_10_21h2< 10.0.19044.501110.0.19044.5011
microsoftwindows_10_22h2< 10.0.19045.501110.0.19045.5011
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2079610.0.10240.20796
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.742810.0.14393.7428
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.641410.0.17763.6414
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.501110.0.19044.5011
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.501110.0.19045.5011
microsoftwindows_11_21h2< 10.0.22000.326010.0.22000.3260
microsoftwindows_11_22h2< 10.0.22621.431710.0.22621.4317
microsoftwindows_11_23h2< 10.0.22631.431710.0.22631.4317
microsoftwindows_11_24h2< 10.0.26100.203310.0.26100.2033
microsoftwindows_11_version_21h2>= 10.0.22000.0 < 10.0.22000.326010.0.22000.3260
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.431710.0.22621.4317
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.431710.0.22631.4317
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.431710.0.22631.4317
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.203310.0.26100.2033
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.273666.1.7601.27366
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.229186.0.6003.22918
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.251186.2.9200.25118
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.222216.3.9600.22221

Detection & IOCsextracted from sources · hover to see the quote

snort
64083 - 64086, 64089, 64090, 64111 and 64112
snort
301034 - 301036 and 301041
  • Monitor for opening of untrusted MSC (Microsoft Saved Console) files, which are the delivery mechanism for CVE-2024-43572 exploitation.
  • The attack technique GrimResource leverages an old XSS vulnerability combined with a specially crafted MSC file to gain code execution; hunt for MSC files triggering script execution.
  • MSC files are associated with Windows Command Prompt and PowerShell environments and can store command history; alert on MMC.exe loading MSC files from untrusted or user-writable paths.
  • Use Cisco Talos Snort rules 64083–64086, 64089, 64090, 64111, 64112 (Snort 2) and 301034–301036, 301041 (Snort 3) to detect exploitation attempts.
  • ·Microsoft has not released technical details on how CVE-2024-43572 is being exploited in the wild; detection must rely on file-type and behavioral heuristics.
  • ·Talos notes that additional Snort rules may be released and current rules are subject to change as more information becomes available.
  • ·Zscaler's protection for CVE-2024-43572 requires both Advanced Cloud Sandbox and Advanced Threat Protection subscriptions.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.