CVE-2023-28220 Overview
CVE-2023-28220 is a remote code execution vulnerability in the Microsoft Windows Layer 2 Tunneling Protocol (L2TP) implementation. The flaw affects a broad range of Windows desktop and Windows Server releases that expose L2TP services on the network. An unauthenticated attacker can send specially crafted protocol traffic to a vulnerable system and trigger code execution in a privileged context. Microsoft addressed the issue in the April 2023 security update cycle. The flaw is tracked under [CWE-591] (sensitive data storage in improperly locked memory) and carries network attack reachability without user interaction.
Critical Impact
Successful exploitation grants remote code execution on unpatched Windows endpoints and servers reachable over L2TP, with no authentication or user interaction required.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2)
- Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, and 2022
Discovery Timeline
- 2023-04-11 - CVE-2023-28220 published to NVD alongside the Microsoft April 2023 security update
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-28220
Vulnerability Analysis
The vulnerability resides in the Windows kernel-mode driver that processes L2TP traffic. L2TP is commonly used to tunnel Point-to-Point Protocol (PPP) sessions across IP networks, often in combination with IPsec for remote-access VPN scenarios. A malformed L2TP packet can drive the affected component into an unsafe state, leading to code execution in the same trust boundary as the protocol handler. Because L2TP listens on UDP port 1701, any system that terminates L2TP tunnels presents network-reachable attack surface. The high attack complexity reflects the need for the attacker to win a specific timing or memory layout condition during exploitation.
Root Cause
The underlying weakness is classified as [CWE-591], sensitive data storage in improperly locked memory. The L2TP processing path manipulates protocol state in memory regions that are not properly synchronized, allowing a remote actor to influence values that the kernel later trusts. Microsoft has not published detailed internal analysis beyond the advisory.
Attack Vector
The attack vector is the network. An attacker delivers crafted L2TP control or data messages to a Windows host that has L2TP enabled, typically a VPN concentrator or RRAS server. No credentials are required, and no user action is needed on the target. Refer to the Microsoft Security Update Guide entry for CVE-2023-28220 for vendor-specific exploitation context. No verified public proof-of-concept code is currently available.
Detection Methods for CVE-2023-28220
Indicators of Compromise
- Unexpected inbound UDP traffic to port 1701 on hosts that do not normally serve L2TP/VPN traffic.
- Crashes, bug checks, or unexplained restarts on Windows servers running Routing and Remote Access Service (RRAS).
- New or unusual child processes spawned by svchost.exe hosting RemoteAccess or RasMan services shortly after L2TP traffic spikes.
Detection Strategies
- Inspect network telemetry for malformed L2TP control messages or anomalous session establishment patterns from untrusted sources.
- Correlate kernel error events and Microsoft-Windows-RemoteAccess event log entries with concurrent UDP/1701 traffic.
- Apply behavioral analytics on VPN-terminating hosts to flag post-exploitation activity such as privilege escalation, credential access, or lateral movement following inbound L2TP traffic.
Monitoring Recommendations
- Continuously monitor RRAS and VPN gateways for unexpected configuration changes or service restarts.
- Capture and retain NetFlow or full packet capture on perimeter segments that expose L2TP for incident reconstruction.
- Alert on outbound connections initiated from VPN-termination servers to non-corporate destinations, which can indicate post-exploitation command-and-control.
How to Mitigate CVE-2023-28220
Immediate Actions Required
- Apply the April 2023 (and later cumulative) Microsoft security updates to all affected Windows 10, Windows 11, and Windows Server systems.
- Inventory hosts running RRAS or otherwise listening on UDP/1701 and prioritize them for patching.
- Restrict L2TP exposure to the public internet using firewall rules, allowing only trusted client ranges where feasible.
Patch Information
Microsoft released fixes through the Windows Update channel referenced in the Microsoft Security Update Guide for CVE-2023-28220. Administrators should validate that the corresponding monthly rollup or security-only update is installed on every affected SKU listed in the advisory, including legacy server releases that require Extended Security Updates.
Workarounds
- Disable the Routing and Remote Access Service on hosts that do not require L2TP VPN termination.
- Block inbound UDP port 1701 at the perimeter and internal segmentation points for systems not acting as VPN concentrators.
- Enforce IPsec with strong pre-shared keys or certificates so that unauthenticated L2TP packets are dropped before reaching the vulnerable code path.
# Configuration example: block inbound L2TP on a Windows host using netsh
netsh advfirewall firewall add rule name="Block Inbound L2TP UDP 1701" \
dir=in action=block protocol=UDP localport=1701
# Disable the Remote Access service if L2TP termination is not required
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
