Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-30070: Windows DHCP Server Can Be Crashed by Malicious Data

CVE-2024-30070 · published 2 years ago

Summary

A flaw in the Windows DHCP server can cause it to crash or become unresponsive when it receives certain types of data. This can disrupt network services and prevent devices from getting IP addresses. To fix this, update your Windows DHCP server to the latest version or apply a security patch.

What to do

Update microsoft windows server 2012 to version 6.2.9200.24919 or later.
Update microsoft windows server 2012 (server core installation) to version 6.2.9200.24919 or later.
Update microsoft windows server 2012 r2 to version 6.3.9600.22023 or later.
Update microsoft windows server 2012 r2 (server core installation) to version 6.3.9600.22023 or later.
Update microsoft windows server 2016 to version 10.0.14393.7070 or later.
Update microsoft windows server 2016 (server core installation) to version 10.0.14393.7070 or later.
Update microsoft windows server 2019 to version 10.0.17763.5936 or later.
Update microsoft windows server 2019 (server core installation) to version 10.0.17763.5936 or later.
Update microsoft windows_server_2016 to version 10.0.14393.7070 or later.
Update microsoft windows_server_2019 to version 10.0.17763.5936 or later.

Affected software

Vendor	Product	Affected versions
microsoft	windows server 2012	< 6.2.9200.24919
microsoft	windows server 2012 (server core installation)	< 6.2.9200.24919
microsoft	windows server 2012 r2	< 6.3.9600.22023
microsoft	windows server 2012 r2 (server core installation)	< 6.3.9600.22023
microsoft	windows server 2016	< 10.0.14393.7070
microsoft	windows server 2016 (server core installation)	< 10.0.14393.7070
microsoft	windows server 2019	< 10.0.17763.5936
microsoft	windows server 2019 (server core installation)	< 10.0.17763.5936
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_server_2016	< 10.0.14393.7070 `cpe:2.3:o:microsoft:windows_server_2016::::::::`
microsoft	windows_server_2019	< 10.0.17763.5936 `cpe:2.3:o:microsoft:windows_server_2019::::::::`

Original advisory text

DHCP Server Service Denial of Service Vulnerability

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30070 Patch Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Type

CWE-191Integer Underflow (Wrap or Wraparound)

Timeline

Published11 Jun 2024

Updated29 Oct 2026

First seen20 Jul 2026

Sources

CVE-2024-30070 · NVD

CVE-2024-30070 · MITRE

Track software like this

Free during beta