Risk Letters

Exploited vulnerability

CVE-2024-21338

TLP:CLEAR

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

Facts

  • Vendor: Microsoft
  • Product: Windows
  • CVSS: 7.8
  • EPSS (probability of exploitation within 30 days): 59.8 %
  • On CISA's Known Exploited Vulnerabilities list since: 4 March 2024
  • First known exploitation: 4 March 2024
  • Used in ransomware campaigns (per CISA): Yes
  • CISA's deadline for US federal agencies: 25 March 2024
  • Weakness: CWE-822
  • First seen by Risk Letters: 4 March 2024

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD