CVE-2024-43620HighCVSS 8.8

Windows Telephony Service Remote Code Execution Vulnerability

Published
November 12, 2024
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2024-43620 →

📋 Description

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution? This attack requires a client to connect to a malicious server, and that could allow the attacker to gain code execution on the client.

How could an attacker exploit this vulnerability? An attacker could exploit this vulnerability by tricking a user into sending a request to a malicious server. This could result in the server returning malicious data that might cause arbitrary code execution on the user's system.

🎯 Affected products37

  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 11 Version 23H2 for ARM64-based Systems
  • Windows 11 Version 23H2 for x64-based Systems
  • Windows 11 Version 24H2 for ARM64-based Systems
  • Windows 11 Version 24H2 for x64-based Systems
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • +7 more not shown

✅ Remediation

KB5046615 (Security Update) — fixed build 10.0.17763.6532 KB5046616 (Security Update) — fixed build 10.0.20348.2849 KB5046698 (SecurityHotpatchUpdate) — fixed build 10.0.20348.2819 KB5046613 (Security Update) — fixed build 10.0.19044.5131 KB5046633 (Security Update) — fixed build 10.0.22621.4460 KB5046613 (Security Update) — fixed build 10.0.19045.5131 KB5046633 (Security Update) — fixed build 10.0.22631.4460 KB5046618 (Security Update) — fixed build 10.0.25398.1251 KB5046617 (Security Update) — fixed build 10.0.26100.2314 KB5046696 (SecurityHotpatchUpdate) — fixed build 10.0.26100.2240 KB5046665 (Security Update) — fixed build 10.0.10240.20826 KB5046612 (Security Update) — fixed build 10.0.14393.7515 KB5046661 (Monthly Rollup) — fixed build 6.0.6003.22966 KB5046639 (Security Only) — fixed build 6.0.6003.22966 KB5046687 (Monthly Rollup) — fixed build 6.1.7601.27415 KB5046705 (Security Only) — fixed build 6.1.7601.27415 KB5046697 (Monthly Rollup) — fixed build 6.2.9200.25165 KB5046682 (Monthly Rollup) — fixed build 6.3.9600.22267

🔗 References (33)