Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2022-21907

HTTP Protocol Stack Remote Code Execution Vulnerability

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 10.0.17763.2452, 10.0.19043.1466, 10.0.20348.469, 10.0.19042.1466, 10.0.22000.434, and 1 more
1 on Exploit-DB, 16 proofs of concept on GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total

Summary

HTTP Protocol Stack Remote Code Execution Vulnerability

Timeline

  1. CVE published
  2. Public exploit on Exploit-DB

    EDB-51575

  3. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: total

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Microsoft Windows 10 Version 1809

    From 10.0.17763.0 · fixed in 10.0.17763.2452

  • Microsoft Windows 10 Version 1809

    From 10.0.0 · fixed in 10.0.17763.2452

  • Microsoft Windows Server 2019

    From 10.0.17763.0 · fixed in 10.0.17763.2452

  • Microsoft Windows Server 2019 (Server Core installation)

    From 10.0.17763.0 · fixed in 10.0.17763.2452

  • Microsoft Windows 10 Version 21H1

    From 10.0.0 · fixed in 10.0.19043.1466

  • Microsoft Windows Server 2022

    From 10.0.20348.0 · fixed in 10.0.20348.469

  • Microsoft Windows 10 Version 20H2

    From 10.0.0 · fixed in 10.0.19042.1466

  • Microsoft Windows Server version 20H2

    From 10.0.0 · fixed in 10.0.19042.1466

  • Microsoft Windows 11 version 21H2

    From 10.0.0 · fixed in 10.0.22000.434

  • Microsoft Windows 10 Version 21H2

    From 10.0.19043.0 · fixed in 10.0.19044.1466

References 18

msrc.microsoft.com

Exploit-DB

GitHub · 0xmaximus/Home-Demolisher

GitHub · EzoomE/CVE-2022-21907-RCE

GitHub · Malwareman007/CVE-2022-21907

GitHub · ZZ-SOCMAP/CVE-2022-21907

GitHub · asepsaepdin/CVE-2022-21907

GitHub · cassie0206/CVE-2022-21907

GitHub · corelight/cve-2022-21907

GitHub · gpiechnik2/nmap-CVE-2022-21907

GitHub · iveresk/cve-2022-21907

GitHub · iveresk/cve-2022-21907-http.sys

GitHub · kamal-marouane/CVE-2022-21907

GitHub · mauricelambert/CVE-2022-21907

GitHub · michelep/CVE-2022-21907-Vulnerability-PoC

GitHub · p0dalirius/CVE-2022-21907-http.sys

GitHub · polakow/CVE-2022-21907

GitHub · siboy17/CVE-2022-21907-http.sys