The US cybersecurity agency CISA has warned of a critical vulnerability in Windows that hackers are already exploiting in real-world attacks. It allows an attacker to remotely execute code on an unprotected computer via Windows Internet Key Exchange without any user intervention.
The US cybersecurity agency CISA has warned of a critical vulnerability in Windows that hackers are already exploiting in real-world attacks. It allows an attacker to remotely execute code on an unprotected computer via Windows Internet Key Exchange without any user intervention.
This is reported by Bleeping Computer.
The vulnerability affects versions of Windows 10, Windows 11, and Windows Server.
The issue was found in the Windows Internet Key Exchange, or IKE, component. It is required for establishing secure network connections and is used in some VPNs, in particular. The component itself has a memory error.
To attack, an attacker needs to know the address of a computer or server on the network and be able to send data to it on the ports through which IKE works. Then, the hacker can send a specially crafted network packet to a computer with IKEv2 enabled that triggers this error. If the attack works, the attacker can potentially execute their own code on the machine.
The easiest way to protect yourself is to install the latest Windows updates. If you can't update yet, you should close ports 500 and 4500 to external connections unless IKE is used, or allow access to them only to trusted devices.
Previously, dev.uawrote about another dangerous Windows vulnerability — ShieldBreak in Microsoft Defender. It allows an attacker to replace a system file and gain the highest privileges on the computer, using the antivirus itself.
