Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2024-43541: Microsoft Simple Certificate Enrollment Protocol can be crashed by attackers
CVE-2024-43541 · published 2 years ago
Summary
The Simple Certificate Enrollment Protocol in Microsoft products can be exploited by attackers to crash the service, making it unavailable. This could cause disruptions to certificate management and potentially impact online services. Microsoft has released a patch to fix this issue, and we recommend applying it to ensure system stability and security.
What to do
- Update microsoft windows_server_2016 to version 10.0.14393.7428 or later.
- Update microsoft windows_server_2019 to version 10.0.17763.6414 or later.
- Update microsoft windows_server_2022 to version 10.0.20348.2762 or later.
- Update microsoft windows_server_2022_23h2 to version 10.0.25398.1189 or later.
- Update microsoft windows server 2008 service pack 2 to version 6.0.6003.22918 or later.
- Update microsoft windows server 2008 r2 service pack 1 to version 6.1.7601.27366 or later.
- Update microsoft windows server 2008 r2 service pack 1 (server core installation) to version 6.1.7601.27366 or later.
- Update microsoft windows server 2008 service pack 2 to version 6.0.6003.22918 or later.
- Update microsoft windows server 2008 service pack 2 (server core installation) to version 6.0.6003.22918 or later.
- Update microsoft windows server 2012 to version 6.2.9200.25118 or later.
- Update microsoft windows server 2012 (server core installation) to version 6.2.9200.25118 or later.
- Update microsoft windows server 2012 r2 to version 6.3.9600.22221 or later.
- Update microsoft windows server 2012 r2 (server core installation) to version 6.3.9600.22221 or later.
- Update microsoft windows server 2016 to version 10.0.14393.7428 or later.
- Update microsoft windows server 2016 (server core installation) to version 10.0.14393.7428 or later.
- Update microsoft windows server 2019 to version 10.0.17763.6414 or later.
- Update microsoft windows server 2019 (server core installation) to version 10.0.17763.6414 or later.
- Update microsoft windows server 2022 to version 10.0.20348.2762 or later.
- Update microsoft windows server 2022, 23h2 edition (server core installation) to version 10.0.25398.1189 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | windows_server_2008 |
r2 cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* |
| microsoft | windows_server_2012 |
r2 cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* |
| microsoft | windows_server_2016 |
< 10.0.14393.7428 cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* |
| microsoft | windows_server_2019 |
< 10.0.17763.6414 cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* |
| microsoft | windows_server_2022 |
< 10.0.20348.2762 cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* |
| microsoft | windows_server_2022_23h2 |
< 10.0.25398.1189 cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* |
| microsoft | windows server 2008 service pack 2 | < 6.0.6003.22918 |
| microsoft | windows server 2008 r2 service pack 1 | < 6.1.7601.27366 |
| microsoft | windows server 2008 r2 service pack 1 (server core installation) | < 6.1.7601.27366 |
| microsoft | windows server 2008 service pack 2 | < 6.0.6003.22918 |
| microsoft | windows server 2008 service pack 2 (server core installation) | < 6.0.6003.22918 |
| microsoft | windows server 2012 | < 6.2.9200.25118 |
| microsoft | windows server 2012 (server core installation) | < 6.2.9200.25118 |
| microsoft | windows server 2012 r2 | < 6.3.9600.22221 |
| microsoft | windows server 2012 r2 (server core installation) | < 6.3.9600.22221 |
| microsoft | windows server 2016 | < 10.0.14393.7428 |
| microsoft | windows server 2016 (server core installation) | < 10.0.14393.7428 |
| microsoft | windows server 2019 | < 10.0.17763.6414 |
| microsoft | windows server 2019 (server core installation) | < 10.0.17763.6414 |
| microsoft | windows server 2022 | < 10.0.20348.2762 |
| microsoft | windows server 2022, 23h2 edition (server core installation) | < 10.0.25398.1189 |
Original advisory text
Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability
Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43541 Patch Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published8 Oct 2024
Updated29 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta