Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-21695: Microsoft PEAP Vulnerability: Unauthenticated Code Execution

CVE-2023-21695 · published 3 years ago

Summary

Microsoft's Protected Extensible Authentication Protocol (PEAP) is affected by a vulnerability that could allow an attacker to execute malicious code on a system without needing a password. This could lead to unauthorized access and data theft. Update your Microsoft systems to the latest version to fix this issue.

What to do

Update microsoft windows 10 version 1507 to version 10.0.10240.19747 or later.
Update microsoft windows 10 version 1607 to version 10.0.14393.5717 or later.
Update microsoft windows 10 version 1809 to version 10.0.17763.4010 or later.
Update microsoft windows 10 version 20h2 to version 10.0.19042.2604 or later.
Update microsoft windows 10 version 21h2 to version 10.0.19044.2604 or later.
Update microsoft windows 10 version 22h2 to version 10.0.19045.2604 or later.
Update microsoft windows 11 version 21h2 to version 10.0.22621.1574 or later.
Update microsoft windows 11 version 22h2 to version 10.0.22621.1265 or later.
Update microsoft windows server 2008 service pack 2 to version 6.0.6003.21915 or later.
Update microsoft windows server 2008 r2 service pack 1 to version 6.1.7601.26366 or later.
Update microsoft windows server 2008 r2 service pack 1 (server core installation) to version 6.1.7601.26366 or later.
Update microsoft windows server 2008 service pack 2 to version 6.0.6003.21915 or later.
Update microsoft windows server 2008 service pack 2 (server core installation) to version 6.0.6003.21915 or later.
Update microsoft windows server 2012 to version 6.2.9200.24116 or later.
Update microsoft windows server 2012 (server core installation) to version 6.2.9200.24116 or later.
Update microsoft windows server 2012 r2 to version 6.3.9600.20821 or later.
Update microsoft windows server 2012 r2 (server core installation) to version 6.3.9600.20821 or later.
Update microsoft windows server 2016 to version 10.0.14393.5717 or later.
Update microsoft windows server 2016 (server core installation) to version 10.0.14393.5717 or later.
Update microsoft windows server 2019 to version 10.0.17763.4010 or later.
Update microsoft windows server 2019 (server core installation) to version 10.0.17763.4010 or later.
Update microsoft windows server 2022 to version 10.0.20348.1547 or later.
Update microsoft windows_10 to version 10.0.10240.19747 or later.
Update microsoft windows_10_1607 to version 10.0.14393.5717 or later.
Update microsoft windows_10_1809 to version 10.0.17763.4010 or later.
Update microsoft windows_10_20h2 to version 10.0.19042.2604 or later.
Update microsoft windows_10_21h2 to version 10.0.19044.2604 or later.
Update microsoft windows_10_22h2 to version 10.0.19045.2604 or later.
Update microsoft windows_11_21h2 to version 10.0.22000.1574 or later.
Update microsoft windows_11_22h2 to version 10.0.22621.1265 or later.

Affected software

Vendor	Product	Affected versions
microsoft	windows 10 version 1507	< 10.0.10240.19747
microsoft	windows 10 version 1607	< 10.0.14393.5717
microsoft	windows 10 version 1809	< 10.0.17763.4010
microsoft	windows 10 version 20h2	< 10.0.19042.2604
microsoft	windows 10 version 21h2	< 10.0.19044.2604
microsoft	windows 10 version 22h2	< 10.0.19045.2604
microsoft	windows 11 version 21h2	< 10.0.22621.1574
microsoft	windows 11 version 22h2	< 10.0.22621.1265
microsoft	windows server 2008 service pack 2	< 6.0.6003.21915
microsoft	windows server 2008 r2 service pack 1	< 6.1.7601.26366
microsoft	windows server 2008 r2 service pack 1 (server core installation)	< 6.1.7601.26366
microsoft	windows server 2008 service pack 2	< 6.0.6003.21915
microsoft	windows server 2008 service pack 2 (server core installation)	< 6.0.6003.21915
microsoft	windows server 2012	< 6.2.9200.24116
microsoft	windows server 2012 (server core installation)	< 6.2.9200.24116
microsoft	windows server 2012 r2	< 6.3.9600.20821
microsoft	windows server 2012 r2 (server core installation)	< 6.3.9600.20821
microsoft	windows server 2016	< 10.0.14393.5717
microsoft	windows server 2016 (server core installation)	< 10.0.14393.5717
microsoft	windows server 2019	< 10.0.17763.4010
microsoft	windows server 2019 (server core installation)	< 10.0.17763.4010
microsoft	windows server 2022	< 10.0.20348.1547
microsoft	windows_10	< 10.0.10240.19747 `cpe:2.3:o:microsoft:windows_10::::::::`
microsoft	windows_10_1607	< 10.0.14393.5717 `cpe:2.3:o:microsoft:windows_10_1607::::::::`
microsoft	windows_10_1809	< 10.0.17763.4010 `cpe:2.3:o:microsoft:windows_10_1809::::::::`
microsoft	windows_10_20h2	< 10.0.19042.2604 `cpe:2.3:o:microsoft:windows_10_20h2::::::::`
microsoft	windows_10_21h2	< 10.0.19044.2604 `cpe:2.3:o:microsoft:windows_10_21h2::::::::`
microsoft	windows_10_22h2	< 10.0.19045.2604 `cpe:2.3:o:microsoft:windows_10_22h2::::::::`
microsoft	windows_11_21h2	< 10.0.22000.1574 `cpe:2.3:o:microsoft:windows_11_21h2::::::::`
microsoft	windows_11_22h2	< 10.0.22621.1265 `cpe:2.3:o:microsoft:windows_11_22h2::::::::`
microsoft	windows_server_2008	r2 `cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_server_2016	All versions `cpe:2.3:o:microsoft:windows_server_2016:-:::::::*`
microsoft	windows_server_2019	All versions `cpe:2.3:o:microsoft:windows_server_2019:-:::::::*`
microsoft	windows_server_2022	All versions `cpe:2.3:o:microsoft:windows_server_2022:-:::::::*`

Original advisory text

Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21695 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published14 Feb 2023

Updated4 Nov 2026

First seen19 Aug 2026

Sources

CVE-2023-21695 · NVD

CVE-2023-21695 · MITRE

Track software like this

Free during beta