Lucene search

K
schneierBruce SchneierSCHNEIER:8395C93507B785D8138ED1C832440102
HistoryAug 16, 2024 - 11:07 a.m.

New Windows IPv6 Zero-Click Vulnerability

2024-08-1611:07:29
Bruce Schneier
www.schneier.com
47
windows
ipv6
zero-click
vulnerability
exploitability
patching

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

41.9%

The press is reporting a critical Windows vulnerability affecting IPv6.

> As Microsoft explained in its Tuesday advisory, unauthenticated attackers can exploit the flaw remotely in low-complexity attacks by repeatedly sending IPv6 packets that include specially crafted packets.
>
> Microsoft also shared its exploitability assessment for this critical vulnerability, tagging it with an "exploitation more likely" label, which means that threat actors could create exploit code to "consistently exploit the flaw in attacks."

Details are being withheld at the moment. Microsoft strongly recommends patching now.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

41.9%