CVE-2024-43572

7.8

HIGH CVSS 3.1

Microsoft Windows Management Console Remote Code Execution Vulnerability - [Actively Exploited]

Description

Microsoft Management Console Remote Code Execution Vulnerability

INFO

Published Date :

Oct. 8, 2024, 6:15 p.m.

Last Modified :

Oct. 25, 2024, 6:17 p.m.

Remotely Exploit :

No

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Oct 29, 2024

Alert Date: Oct 08, 2024 | 321 days ago

Description :

Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://msrc.microsoft.com/update-guide/advisory/CVE-2024-43572 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43572

Affected Products

The following products are affected by CVE-2024-43572 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	windows_server_2008
2	Microsoft	windows_server_2012
3	Microsoft	windows_server_2016
4	Microsoft	windows_server_2019
5	Microsoft	windows_10_1607
6	Microsoft	windows_10_1809
7	Microsoft	windows_10_21h2
8	Microsoft	windows_10_22h2
9	Microsoft	windows_server_2022
10	Microsoft	windows_11_21h2
11	Microsoft	windows_11_22h2
12	Microsoft	windows_10_1507
13	Microsoft	windows
14	Microsoft	windows_11_23h2
15	Microsoft	windows_server_2022_23h2
16	Microsoft	windows_server_23h2
17	Microsoft	windows_server_2012_r2
18	Microsoft	windows_server_2008_r2
19	Microsoft	windows_server_2008_sp2
20	Microsoft	windows_11_24h2
21	Microsoft	windows_11_22h3

: Total Affected Vendor : 1 | Products : 21

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]

Solution

This vulnerability allows for remote code execution; apply the latest security updates to address this issue.

Apply the appropriate security update for your Windows version.
Reboot the system if required.

Public PoC/Exploit Available at Github

CVE-2024-43572 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-43572.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43572	Patch Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-43572 is associated with the following CWEs:

CWE-707: Improper Neutralization

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-43572 weaknesses.

CAPEC-3: Using Leading 'Ghost' Character Sequences to Bypass Input Filters Using Leading 'Ghost' Character Sequences to Bypass Input Filters CAPEC-7: Blind SQL Injection Blind SQL Injection CAPEC-43: Exploiting Multiple Input Interpretation Layers Exploiting Multiple Input Interpretation Layers CAPEC-52: Embedding NULL Bytes Embedding NULL Bytes CAPEC-53: Postfix, Null Terminate, and Backslash Postfix, Null Terminate, and Backslash CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic Using Slashes and URL Encoding Combined to Bypass Validation Logic CAPEC-78: Using Escaped Slashes in Alternate Encoding Using Escaped Slashes in Alternate Encoding CAPEC-79: Using Slashes in Alternate Encoding Using Slashes in Alternate Encoding CAPEC-83: XPath Injection XPath Injection CAPEC-84: XQuery Injection XQuery Injection CAPEC-250: XML Injection XML Injection CAPEC-276: Inter-component Protocol Manipulation Inter-component Protocol Manipulation CAPEC-277: Data Interchange Protocol Manipulation Data Interchange Protocol Manipulation CAPEC-278: Web Services Protocol Manipulation Web Services Protocol Manipulation CAPEC-279: SOAP Manipulation SOAP Manipulation CAPEC-468: Generic Cross-Browser Cross-Domain Theft Generic Cross-Browser Cross-Domain Theft

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

hackthebox/university-ctf-2024

Official writeups for Hack The Box University CTF 2024

Python Shell

Updated: 3 months, 3 weeks ago

25 stars 3 fork 3 watcher

Born at : Dec. 16, 2024, 12:04 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-43572 vulnerability anywhere in the article.

Proofpoint

The Bitter End: Unraveling Eight Years of Espionage Antics—Part One

June 04, 2025 Nick Attfield and Konstantin Klinger in collaboration with Threatray’s Abdallah Elshinbary and Jonas Wagner This is a two-part blog series, detailing research undertaken in collaboration ...

Published Date: Jun 04, 2025 (2 months, 2 weeks ago)

Daily CyberSecurity

Critical Vulnerability (CVE-2025-31498) Patched in c-ares DNS Library

The Domain Name System (DNS) plays a pivotal role, translating human-friendly domain names into the numerical IP addresses that computers understand. And at the heart of many applications facilitating ...

Published Date: Apr 11, 2025 (4 months, 2 weeks ago)

Daily CyberSecurity

CISA Warns of Actively Exploited Linux Kernel Vulnerabilities (CVE-2024-53197, CVE-2024-53150)

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning after adding two newly discovered Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, co ...

Published Date: Apr 10, 2025 (4 months, 2 weeks ago)

Daily CyberSecurity

Seven Years Later: Cisco CVE-2018-0171 Still Exposes Thousands to RCE

In a deep dive published by Guy Bruneau, Senior Security Consultant and former network engineer, the lingering dangers of a years-old Cisco vulnerability—CVE-2018-0171—are laid bare with fresh insight ...

Published Date: Apr 10, 2025 (4 months, 2 weeks ago)

Daily CyberSecurity

Critical SSRF Vulnerability Patched in LNbits Lightning Wallet Server

LNbits, the modular and extendable Lightning Network wallet server, has patched a critical Server-Side Request Forgery (SSRF) vulnerability that exposed internal services to potential exploitation via ...

Published Date: Apr 10, 2025 (4 months, 2 weeks ago)

Daily CyberSecurity

High-Severity XXE Vulnerability Found in NAKIVO Backup & Replication

A high-severity security vulnerability has been identified in NAKIVO Backup & Replication, a popular data protection solution. The vulnerability, classified as an XML External Entity (XXE) issue and t ...

Published Date: Apr 10, 2025 (4 months, 2 weeks ago)

Daily CyberSecurity

Critical Vulnerabilities: CISA Alerts to Windows CLFS and Gladinet CentreStack Threats

Recently, the Cybersecurity and Infrastructure Security Agency (CISA) added two significant vulnerabilities to its Known Exploited Vulnerabilities Catalog, highlighting the urgency for users to apply ...