CVE-2023-35366 Overview
CVE-2023-35366 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw stems from improper input validation [CWE-20] in the RRAS component, allowing a network-based attacker to execute arbitrary code on affected systems. The vulnerability affects a broad range of Windows desktop and server versions, including Windows 10, Windows 11, and Windows Server editions from 2008 through 2022. Exploitation requires no authentication and no user interaction, making it attractive for opportunistic attackers targeting exposed RRAS endpoints. Microsoft addressed the issue in the July 2023 security update.
Critical Impact
An unauthenticated attacker who successfully exploits this vulnerability can execute code in the context of the RRAS service, leading to full system compromise on Windows hosts with the role enabled.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2)
- Microsoft Windows Server 2008, 2012, 2012 R2, 2016, 2019, and 2022
Discovery Timeline
- 2023-07-11 - CVE-2023-35366 published to NVD and addressed in Microsoft's July 2023 Patch Tuesday
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-35366
Vulnerability Analysis
The vulnerability resides in the Windows Routing and Remote Access Service, a Windows Server role that provides routing, VPN, and dial-up remote access functionality. RRAS processes inbound protocol traffic across multiple network interfaces. Improper validation of attacker-controlled input within this processing path allows a remote adversary to corrupt service state and direct execution flow. Because RRAS typically runs with elevated privileges, successful exploitation grants the attacker high-privilege code execution on the target host. The vulnerability impacts confidentiality, integrity, and availability simultaneously, enabling data theft, persistence, and lateral movement from the compromised server.
Root Cause
The root cause is categorized under [CWE-20] Improper Input Validation. The RRAS component fails to adequately validate fields within network traffic it processes, permitting malformed or crafted input to trigger unsafe code paths. Microsoft has not publicly disclosed the precise affected function or protocol parser.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends a specially crafted request to a server running RRAS to trigger the flaw. The vulnerability is only exploitable on systems where the RRAS role is explicitly installed and enabled. RRAS is not enabled by default on Windows installations, which limits the exposed attack surface. However, RRAS is commonly deployed on edge VPN gateways and branch routers, where exposure to untrusted networks is high. Refer to the Microsoft Security Update CVE-2023-35366 advisory for protocol-level details.
Detection Methods for CVE-2023-35366
Indicators of Compromise
- Unexpected crashes or restarts of the RemoteAccess service or the svchost.exe process hosting RRAS
- Anomalous child processes spawned by the RRAS service host, particularly command interpreters such as cmd.exe or powershell.exe
- Inbound connections to RRAS listener ports from untrusted networks followed by outbound beaconing
Detection Strategies
- Inventory all Windows hosts with the RRAS role installed and confirm the July 2023 cumulative update is applied
- Inspect Windows Event Logs for RRAS service errors, abnormal terminations, and unusual configuration changes
- Apply network intrusion detection signatures for malformed RRAS protocol traffic where vendor signatures are available
Monitoring Recommendations
- Continuously monitor process lineage on RRAS servers to identify suspicious children of the RRAS service host
- Alert on new outbound network connections originating from RRAS-enabled servers to untrusted destinations
- Track authentication and privileged account activity on RRAS hosts to detect post-exploitation lateral movement
How to Mitigate CVE-2023-35366
Immediate Actions Required
- Apply the July 2023 Microsoft security update to all Windows desktop and server systems with the RRAS role enabled
- Identify and disable the RRAS role on any host where it is not actively required
- Restrict inbound network access to RRAS endpoints using firewall rules and network segmentation
Patch Information
Microsoft released security updates addressing CVE-2023-35366 on July 11, 2023. Administrators should consult the Microsoft Security Update CVE-2023-35366 advisory for the specific KB article corresponding to each affected Windows version and apply the appropriate cumulative update through Windows Update or WSUS.
Workarounds
- Disable the Routing and Remote Access service on systems that do not require VPN or routing functionality
- Block inbound traffic to RRAS protocols at the perimeter firewall when the service must remain enabled but is not internet-facing
- Place RRAS gateways behind authenticated VPN concentrators or zero-trust network access proxies to reduce direct exposure
# Disable Routing and Remote Access service on a Windows host
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess
# Verify the service state
sc.exe query RemoteAccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
