Table of Contents

    About the Author

    Connor Jackson

    Connor Jackson

    Connor Jackson is a Security Research Manager at CyberMaxx, with a background in forensics, reverse engineering, and threat-hunting. Check out Connor's LinkedIn

    More Articles

    Additional Resources:

    CrowdStrike, SentinelOne, and MS Defender: The EDR Trio Powering CyberMaxx’s Advanced Threat Detection

    CrowdStrike, SentinelOne, and MS Defender: The EDR Trio Powering CyberMaxx’s Advanced Threat Detection

    Articles

    5 min read

    Behind the Alert: How EDR Use Behavioral Data to Detect Threats

    Behind the Alert: How EDR Use Behavioral Data to Detect Threats

    Articles

    6 min read

    A critical vulnerability has been identified in the Windows TCP/IP Stack that allows for unauthenticated RCE. No user interaction is required, making this a zero-click vulnerability. This vulnerability affects all supported versions of Windows and Windows Servers.

    This remote code vulnerability enables an unauthenticated attacker to repeatedly send IPv6 packets, that include specially crafted packets, to a Windows machine which could enable remote code execution. Microsoft has released urgent security patches and recommends to install these asap.

    It has been assigned a CVSS score of 9.8. With a low complexity to exploit, can be performed unauthenticated and exploited remotely. Successful exploitation leads to SYSTEM level execution on the target endpoint.

    Further Reading:

    CyberMaxx is monitoring the situation and providing updates to customers as new information becomes available. We currently recommend organizations apply the patches provided by Microsoft. This vulnerability can only be exploited by specially crafted IPv6 packets to be sent to the vulnerable endpoint, we recommend disabling IPv6 if not business critical to reduce this attack surface.