Microsoft CVE Summary

This report contains detail for the following vulnerabilities:

Tag	CVE ID	CVE Title
.NET Core	CVE-2023-21538	.NET Denial of Service Vulnerability
3D Builder	CVE-2023-21782	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21781	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21783	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21784	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21791	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21793	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21786	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21790	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21780	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21792	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21789	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21785	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21787	3D Builder Remote Code Execution Vulnerability
3D Builder	CVE-2023-21788	3D Builder Remote Code Execution Vulnerability
Azure Service Fabric Container	CVE-2023-21531	Azure Service Fabric Container Elevation of Privilege Vulnerability
Microsoft Bluetooth Driver	CVE-2023-21739	Windows Bluetooth Driver Elevation of Privilege Vulnerability
Microsoft Exchange Server	CVE-2023-21764	Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server	CVE-2023-21763	Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server	CVE-2023-21762	Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server	CVE-2023-21761	Microsoft Exchange Server Information Disclosure Vulnerability
Microsoft Exchange Server	CVE-2023-21745	Microsoft Exchange Server Spoofing Vulnerability
Microsoft Graphics Component	CVE-2023-21680	Windows Win32k Elevation of Privilege Vulnerability
Microsoft Graphics Component	CVE-2023-21532	Windows GDI Elevation of Privilege Vulnerability
Microsoft Graphics Component	CVE-2023-21552	Windows GDI Elevation of Privilege Vulnerability
Microsoft Local Security Authority Server (lsasrv)	CVE-2023-21728	Windows Netlogon Denial of Service Vulnerability
Microsoft Message Queuing	CVE-2023-21537	Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
Microsoft Office	CVE-2023-21734	Microsoft Office Remote Code Execution Vulnerability
Microsoft Office	CVE-2023-21735	Microsoft Office Remote Code Execution Vulnerability
Microsoft Office SharePoint	CVE-2023-21742	Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft Office SharePoint	CVE-2023-21743	Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft Office SharePoint	CVE-2023-21744	Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft Office Visio	CVE-2023-21741	Microsoft Office Visio Information Disclosure Vulnerability
Microsoft Office Visio	CVE-2023-21736	Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio	CVE-2023-21737	Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio	CVE-2023-21738	Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft WDAC OLE DB provider for SQL	CVE-2023-21681	Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Visual Studio Code	CVE-2023-21779	Visual Studio Code Remote Code Execution
Windows ALPC	CVE-2023-21674	Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock	CVE-2023-21768	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Authentication Methods	CVE-2023-21539	Windows Authentication Remote Code Execution Vulnerability
Windows Backup Engine	CVE-2023-21752	Windows Backup Service Elevation of Privilege Vulnerability
Windows Bind Filter Driver	CVE-2023-21733	Windows Bind Filter Driver Elevation of Privilege Vulnerability
Windows BitLocker	CVE-2023-21563	BitLocker Security Feature Bypass Vulnerability
Windows Boot Manager	CVE-2023-21560	Windows Boot Manager Security Feature Bypass Vulnerability
Windows Credential Manager	CVE-2023-21726	Windows Credential Manager User Interface Elevation of Privilege Vulnerability
Windows Cryptographic Services	CVE-2023-21559	Windows Cryptographic Information Disclosure Vulnerability
Windows Cryptographic Services	CVE-2023-21551	Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Windows Cryptographic Services	CVE-2023-21561	Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Windows Cryptographic Services	CVE-2023-21540	Windows Cryptographic Information Disclosure Vulnerability
Windows Cryptographic Services	CVE-2023-21730	Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Windows Cryptographic Services	CVE-2023-21550	Windows Cryptographic Information Disclosure Vulnerability
Windows DWM Core Library	CVE-2023-21724	Microsoft DWM Core Library Elevation of Privilege Vulnerability
Windows Error Reporting	CVE-2023-21558	Windows Error Reporting Service Elevation of Privilege Vulnerability
Windows Event Tracing	CVE-2023-21536	Event Tracing for Windows Information Disclosure Vulnerability
Windows IKE Extension	CVE-2023-21758	Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Windows IKE Extension	CVE-2023-21683	Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Windows IKE Extension	CVE-2023-21677	Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Windows Installer	CVE-2023-21542	Windows Installer Elevation of Privilege Vulnerability
Windows Internet Key Exchange (IKE) Protocol	CVE-2023-21547	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
Windows iSCSI	CVE-2023-21527	Windows iSCSI Service Denial of Service Vulnerability
Windows Kernel	CVE-2023-21755	Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel	CVE-2023-21753	Event Tracing for Windows Information Disclosure Vulnerability
Windows Layer 2 Tunneling Protocol	CVE-2023-21556	Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Windows Layer 2 Tunneling Protocol	CVE-2023-21555	Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Windows Layer 2 Tunneling Protocol	CVE-2023-21543	Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Windows Layer 2 Tunneling Protocol	CVE-2023-21546	Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Windows Layer 2 Tunneling Protocol	CVE-2023-21679	Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability
Windows LDAP - Lightweight Directory Access Protocol	CVE-2023-21676	Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows LDAP - Lightweight Directory Access Protocol	CVE-2023-21557	Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Windows Local Security Authority (LSA)	CVE-2023-21524	Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Windows Local Session Manager (LSM)	CVE-2023-21771	Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability
Windows Malicious Software Removal Tool	CVE-2023-21725	Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability
Windows Management Instrumentation	CVE-2023-21754	Windows Kernel Elevation of Privilege Vulnerability
Windows NTLM	CVE-2023-21746	Windows NTLM Elevation of Privilege Vulnerability
Windows ODBC Driver	CVE-2023-21732	Microsoft ODBC Driver Remote Code Execution Vulnerability
Windows Overlay Filter	CVE-2023-21766	Windows Overlay Filter Information Disclosure Vulnerability
Windows Overlay Filter	CVE-2023-21767	Windows Overlay Filter Elevation of Privilege Vulnerability
Windows Point-to-Point Tunneling Protocol	CVE-2023-21682	Windows Point-to-Point Protocol (PPP) Information Disclosure Vulnerability
Windows Print Spooler Components	CVE-2023-21760	Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Components	CVE-2023-21765	Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Components	CVE-2023-21678	Windows Print Spooler Elevation of Privilege Vulnerability
Windows Remote Access Service L2TP Driver	CVE-2023-21757	Windows Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability
Windows RPC API	CVE-2023-21525	Remote Procedure Call Runtime Denial of Service Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP)	CVE-2023-21548	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP)	CVE-2023-21535	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Smart Card	CVE-2023-21759	Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
Windows Task Scheduler	CVE-2023-21541	Windows Task Scheduler Elevation of Privilege Vulnerability
Windows Virtual Registry Provider	CVE-2023-21772	Windows Kernel Elevation of Privilege Vulnerability
Windows Virtual Registry Provider	CVE-2023-21748	Windows Kernel Elevation of Privilege Vulnerability
Windows Virtual Registry Provider	CVE-2023-21773	Windows Kernel Elevation of Privilege Vulnerability
Windows Virtual Registry Provider	CVE-2023-21747	Windows Kernel Elevation of Privilege Vulnerability
Windows Virtual Registry Provider	CVE-2023-21776	Windows Kernel Information Disclosure Vulnerability
Windows Virtual Registry Provider	CVE-2023-21774	Windows Kernel Elevation of Privilege Vulnerability
Windows Virtual Registry Provider	CVE-2023-21750	Windows Kernel Elevation of Privilege Vulnerability
Windows Virtual Registry Provider	CVE-2023-21675	Windows Kernel Elevation of Privilege Vulnerability
Windows Virtual Registry Provider	CVE-2023-21749	Windows Kernel Elevation of Privilege Vulnerability
Windows Workstation Service	CVE-2023-21549	Windows SMB Witness Service Elevation of Privilege Vulnerability

CVE-2023-21524 - Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21524 MITRE NVD	CVE Title: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability CVSS: CVSS:3.1 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could impersonate the group Managed Service Account (gMSA) to perform actions or access resources over the network. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21524
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Important	Elevation of Privilege		Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21524	Andrey Shaporev with Netwrix

CVE-2023-21532 - Windows GDI Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21532 MITRE NVD	CVE Title: Windows GDI Elevation of Privilege Vulnerability CVSS: CVSS:3.1 7.0/6.1 Base score metrics Attack Vector Local Attack Complexity High Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation More Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21532
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Important	Elevation of Privilege		Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21532	Marcin Wiazowski working with Trend Micro Zero Day Initiative

CVE-2023-21535 - Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21535 MITRE NVD	CVE Title: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability CVSS: CVSS:3.1 8.1/7.1 Base score metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. How could an attacker exploit this vulnerability? An unauthenticated attacker could send a specially crafted connection request to a RAS server, which could lead to remote code execution (RCE) on the RAS server machine. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Critical	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21535
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Critical	Remote Code Execution		Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21535	Yuki Chen with Cyber KunLun

CVE-2023-21538 - .NET Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21538 MITRE NVD	CVE Title: .NET Denial of Service Vulnerability CVSS: CVSS:3.1 7.5/6.5 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21538
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
.NET 6.0	5022546 (Security Update)	Important	Denial of Service	None	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Maybe

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21538	Johan Gorter with AFAS Software

CVE-2023-21546 - Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21546 MITRE NVD	CVE Title: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability CVSS: CVSS:3.1 8.1/7.1 Base score metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. How could an attacker exploit this vulnerability? An unauthenticated attacker could send a specially crafted connection request to a RAS server, which could lead to remote code execution (RCE) on the RAS server machine. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Critical	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21546
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Critical	Remote Code Execution		Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21546	Yuki Chen with Cyber KunLun

CVE-2023-21547 - Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21547 MITRE NVD	CVE Title: Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability CVSS: CVSS:3.1 7.5/6.5 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction None Scope Unchanged Confidentiality None Integrity None Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21547
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Important	Denial of Service	5021243	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Important	Denial of Service	5021243	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Important	Denial of Service	5021235	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Important	Denial of Service	5021235	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Important	Denial of Service	5021237	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Important	Denial of Service	5021237	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Important	Denial of Service	5021237	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Important	Denial of Service	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Important	Denial of Service	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Important	Denial of Service	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Important	Denial of Service	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Important	Denial of Service	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Important	Denial of Service	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Important	Denial of Service	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Important	Denial of Service	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Important	Denial of Service	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Important	Denial of Service	5021234	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Important	Denial of Service	5021234	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Important	Denial of Service	5021255	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Important	Denial of Service	5021255	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Important	Denial of Service	5021235	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Important	Denial of Service	5021235	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Important	Denial of Service	5021237	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Important	Denial of Service	5021237	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Important	Denial of Service	5021249	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Important	Denial of Service	5021249	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21547	Yuki Chen with Cyber KunLun

CVE-2023-21539 - Windows Authentication Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21539 MITRE NVD	CVE Title: Windows Authentication Remote Code Execution Vulnerability CVSS: CVSS:3.1 7.5/6.5 Base score metrics Attack Vector Network Attack Complexity High Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment. According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? An attacker must already have access and the ability to run code on the target system. This technique does not allow for remote code execution in cases where the attacker does not already have that ability on the target system. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21539
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Important	Remote Code Execution	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Important	Remote Code Execution	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Important	Remote Code Execution	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Important	Remote Code Execution	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Important	Remote Code Execution	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Important	Remote Code Execution	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Important	Remote Code Execution	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Important	Remote Code Execution	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Important	Remote Code Execution	5021233	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Important	Remote Code Execution	5021234	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Important	Remote Code Execution	5021234	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Important	Remote Code Execution	5021255	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Important	Remote Code Execution	5021255	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Important	Remote Code Execution	5021249	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Important	Remote Code Execution	5021249	Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21539	Alexander Clouter with coreMem Limited and Alan DeKok with NetworkRADIUS

CVE-2023-21540 - Windows Cryptographic Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21540 MITRE NVD	CVE Title: Windows Cryptographic Information Disclosure Vulnerability CVSS: CVSS:3.1 5.5/4.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is Windows cryptographic secrets. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21540
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Important	Information Disclosure	5021234	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Important	Information Disclosure	5021234	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Important	Information Disclosure	5021255	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Important	Information Disclosure	5021255	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Important	Information Disclosure	5021249	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Important	Information Disclosure	5021249	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21540	Microsoft Offensive Research and Security Engineering (MORSE)

CVE-2023-21541 - Windows Task Scheduler Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21541 MITRE NVD	CVE Title: Windows Task Scheduler Elevation of Privilege Vulnerability CVSS: CVSS:3.1 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation More Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21541
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Important	Elevation of Privilege		Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21541	Ben Lincoln with Bishop Fox

CVE-2023-21542 - Windows Installer Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21542 MITRE NVD	CVE Title: Windows Installer Elevation of Privilege Vulnerability CVSS: CVSS:3.1 7.0/6.1 Base score metrics Attack Vector Local Attack Complexity High Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21542
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Important	Elevation of Privilege		Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21542	QueryX Team of Theori working with Trend Micro Zero Day Initiative

CVE-2023-21543 - Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21543 MITRE NVD	CVE Title: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability CVSS: CVSS:3.1 8.1/7.1 Base score metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment. How could an attacker exploit this vulnerability? An unauthenticated attacker could send a specially crafted connection request to a RAS server, which could lead to remote code execution (RCE) on the RAS server machine. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Critical	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21543
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Critical	Remote Code Execution		Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21543	RyeLv (@b2ahex)

CVE-2023-21548 - Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21548 MITRE NVD	CVE Title: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability CVSS: CVSS:3.1 8.1/7.1 Base score metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. How could an attacker exploit the vulnerability? To exploit this vulnerability, an attacker would need to send a specially crafted malicious SSTP packet to a SSTP server. This could result in remote code execution on the server side. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Critical	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21548
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Critical	Remote Code Execution		Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21548	Yuki Chen with Cyber KunLun

CVE-2023-21549 - Windows SMB Witness Service Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21549 MITRE NVD	CVE Title: Windows SMB Witness Service Elevation of Privilege Vulnerability CVSS: CVSS:3.1 8.8/7.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: How could an attacker exploit the vulnerability? To exploit this vulnerability, an attacker could execute a specially crafted malicious script which executes an RPC call to an RPC host. This could result in elevation of privilege on the server. What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could execute RPC functions that are restricted to privileged accounts only. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	Yes	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21549
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Important	Elevation of Privilege		Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 8.8 Temporal: 7.7 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21549	Stiv Kupchik and Ophir Harpaz with Akamai

CVE-2023-21550 - Windows Cryptographic Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21550 MITRE NVD	CVE Title: Windows Cryptographic Information Disclosure Vulnerability CVSS: CVSS:3.1 5.5/4.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is Windows cryptographic secrets. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21550
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Important	Information Disclosure	5021233	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Important	Information Disclosure	5021234	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Important	Information Disclosure	5021234	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Important	Information Disclosure	5021255	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Important	Information Disclosure	5021255	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Important	Information Disclosure	5021237	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Important	Information Disclosure	5021249	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Important	Information Disclosure	5021249	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21550	Microsoft Offensive Research and Security Engineering (MORSE)

CVE-2023-21551 - Microsoft Cryptographic Services Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21551 MITRE NVD	CVE Title: Microsoft Cryptographic Services Elevation of Privilege Vulnerability CVSS: CVSS:3.1 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Critical	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21551
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Critical	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Critical	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Critical	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Critical	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Critical	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Critical	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Critical	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Critical	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Critical	Elevation of Privilege	5021233	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Critical	Elevation of Privilege	5021234	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Critical	Elevation of Privilege	5021234	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Critical	Elevation of Privilege	5021255	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Critical	Elevation of Privilege	5021255	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Critical	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Critical	Elevation of Privilege	5021237	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Critical	Elevation of Privilege	5021249	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Critical	Elevation of Privilege	5021249	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21551	Microsoft Offensive Research and Security Engineering (MORSE)

CVE-2023-21552 - Windows GDI Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21552 MITRE NVD	CVE Title: Windows GDI Elevation of Privilege Vulnerability CVSS: CVSS:3.1 7.8/7.0 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Proof-of-Concept Remediation Level Official Fix Report Confidence Confirmed FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation More Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21552
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Important	Elevation of Privilege	5021243	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Important	Elevation of Privilege	5021233	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Important	Elevation of Privilege	5021234	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Important	Elevation of Privilege	5021255	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Important	Elevation of Privilege		Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Important	Elevation of Privilege	5021289	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5022338 (Monthly Rollup) 5022339 (Security Only)	Important	Elevation of Privilege	5021291	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Important	Elevation of Privilege	5021285	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Important	Elevation of Privilege	5021294	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Important	Elevation of Privilege	5021235	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Important	Elevation of Privilege	5021237	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Important	Elevation of Privilege	5021249	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21552	luckyu with NSFOCUS TIANYUAN LAB

CVE-2023-21555 - Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21555 MITRE NVD	CVE Title: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability CVSS: CVSS:3.1 8.1/7.1 Base score metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. How could an attacker exploit this vulnerability? An unauthenticated attacker could send a specially crafted connection request to a RAS server, which could lead to remote code execution (RCE) on the RAS server machine. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Critical	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21555
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	5022346 (Security Only)	Critical	Remote Code Execution		Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	5022340 (Monthly Rollup) 5022353 (Security Only)	Critical	Remote Code Execution	5021289	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	5022348 (Monthly Rollup) 5022343 (Security Only)	Critical	Remote Code Execution	5021285	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2022 (Server Core installation)	5022291 (Security Update)	Critical	Remote Code Execution	5021249	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2023-21555	Yuki Chen with Cyber KunLun

CVE-2023-21556 - Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2023-21556 MITRE NVD	CVE Title: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability CVSS: CVSS:3.1 8.1/7.1 Base score metrics Attack Vector Network Attack Complexity High Privileges Required None User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. How could an attacker exploit this vulnerability? An unauthenticated attacker could send a specially crafted connection request to a RAS server, which could lead to remote code execution (RCE) on the RAS server machine. Mitigations: None Workarounds: None Revision: 1.0    2023-01-10T08:00:00     Information published.	Critical	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21556
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	5022297 (Security Update)	Critical	Remote Code Execution	5021243	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	5022289 (Security Update)	Critical	Remote Code Execution	5021235	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	5022286 (Security Update)	Critical	Remote Code Execution	5021237	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 21H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for 32-bit Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for ARM64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 22H2 for x64-based Systems	5022282 (Security Update)	Critical	Remote Code Execution	5021233	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for ARM64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 version 21H2 for x64-based Systems	5022287 (Security Update)	Critical	Remote Code Execution	5021234	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for ARM64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 11 Version 22H2 for x64-based Systems	5022303 (Security Update)	Critical	Remote Code Execution	5021255	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	5022338 (Monthly Rollup) 5022339 (Security Only)	Critical	Remote Code Execution	5021291	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	5021294	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	5022352 (Monthly Rollup) 5022346 (Security Only)	Critical	Remote Code Execution	502129