CVE-2022-21849: Windows 10 IKE Protocol RCE Vulnerability

CVE-2022-21849 Overview

CVE-2022-21849 is a remote code execution vulnerability in the Windows Internet Key Exchange (IKE) Protocol Extensions. The flaw affects supported versions of Windows 10, Windows 11, and Windows Server. An unauthenticated attacker can send specially crafted packets to a vulnerable host over the network. Successful exploitation results in arbitrary code execution with high impact to confidentiality, integrity, and availability. Microsoft published the advisory on January 11, 2022 as part of the January Patch Tuesday cycle. The EPSS probability is 24.8% at the 96.2 percentile, indicating elevated likelihood of exploitation activity compared to most CVEs.

Critical Impact

Unauthenticated attackers can achieve remote code execution on Windows hosts running the IKE Protocol Extensions service, with no user interaction required.

Affected Products

• Microsoft Windows 10 (multiple versions, x86/x64/ARM64)
• Microsoft Windows 11 (x64, ARM64)
• Microsoft Windows Server 2016, 2019, 20H2, and 2022

Discovery Timeline

• 2022-01-11 - CVE-2022-21849 published to NVD
• 2022-01-11 - Microsoft releases security update for IKE Protocol Extensions
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21849

Vulnerability Analysis

The vulnerability resides in the Windows IKE Protocol Extensions component, which handles IKE version 2 (IKEv2) negotiation for IPsec virtual private network (VPN) tunnels. The IKE service listens on UDP ports 500 and 4500 by default. A remote attacker can transmit malformed IKE packets to trigger the flaw and execute arbitrary code in the context of the affected service. No authentication or user interaction is required for exploitation.

Microsoft classifies CVE-2022-21849 as Remote Code Execution. The CWE assignment from NVD is NVD-CWE-noinfo, meaning Microsoft did not publicly disclose the underlying weakness class. The vulnerability is network-reachable wherever Windows IKE/IPsec services are exposed, including VPN gateways and edge servers.

Root Cause

The root cause has not been disclosed in public Microsoft documentation. Based on the IKE attack surface, the issue involves improper handling of attacker-controlled fields during IKE packet parsing inside the IKEEXT service. Microsoft credits the fix to changes within the Windows IKE Protocol Extensions implementation.

Attack Vector

Attackers exploit CVE-2022-21849 by sending crafted IKE protocol traffic to UDP/500 or UDP/4500 on a vulnerable Windows host. Hosts directly exposing IPsec services to the internet are at highest risk. Internal pivoting is also possible where IKE listeners are reachable inside a corporate network.

No public proof-of-concept exploit code is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Public technical details remain limited; see the Microsoft Vulnerability Update CVE-2022-21849 for vendor guidance.

Detection Methods for CVE-2022-21849

Indicators of Compromise

• Anomalous inbound UDP traffic to ports 500 or 4500 from untrusted sources, especially from IPs without prior VPN association.
• Unexpected crashes, restarts, or memory growth of the IKEEXT service in the Windows Event Log.
• New or unexplained child processes spawned in the context of the IKEEXT or Svchost.exe instance hosting IKE services.
• Outbound connections initiated from the IKE service host to attacker infrastructure following inbound IKE traffic.

Detection Strategies

• Monitor Windows Event Log channels for service crashes referencing IKEEXT.DLL or related IPsec components.
• Inspect network telemetry for malformed IKEv2 SA_INIT or AUTH payloads originating from unexpected sources.
• Correlate inbound IKE traffic with subsequent process creation events on the host using EDR telemetry.

Monitoring Recommendations

• Baseline normal IKE peer addresses and alert on negotiations from unknown sources.
• Enable command-line auditing and Sysmon process-creation logging on VPN servers and edge gateways.
• Centralize IKE service logs and Windows security events for retroactive hunting after public exploit disclosure.

How to Mitigate CVE-2022-21849

Immediate Actions Required

• Apply the January 2022 Microsoft security updates that address CVE-2022-21849 to all affected Windows 10, Windows 11, and Windows Server systems.
• Inventory hosts running the IKEEXT service and prioritize internet-exposed VPN gateways for patching.
• Restrict inbound UDP/500 and UDP/4500 to known peer addresses using firewall rules.
• Validate patch deployment status across the fleet and remediate exceptions promptly.

Patch Information

Microsoft released fixes on January 11, 2022 as part of the monthly security update cycle. Refer to the Microsoft Security Advisory CVE-2022-21849 for the specific KB articles corresponding to each Windows build. Cumulative updates supersede the original packages; ensure the latest cumulative update for each supported OS branch is installed.

Workarounds

• Block UDP/500 and UDP/4500 at the network perimeter where IKE/IPsec services are not required.
• Disable the IKEEXT (IKE and AuthIP IPsec Keying Modules) service on hosts that do not need IPsec or IKEv2 VPN functionality.
• Restrict IKE peers to specific trusted addresses using Windows Defender Firewall connection security rules.

# Disable the IKEEXT service on systems that do not require IPsec/IKEv2
sc.exe config IKEEXT start= disabled
sc.exe stop IKEEXT

# Restrict inbound IKE traffic to a specific trusted peer
netsh advfirewall firewall add rule name="Restrict IKE 500" dir=in action=block protocol=UDP localport=500 remoteip=any
netsh advfirewall firewall add rule name="Allow IKE 500 Trusted" dir=in action=allow protocol=UDP localport=500 remoteip=<trusted_peer_ip>