CVE-2024-21348 Overview
CVE-2024-21348 is a denial of service vulnerability affecting the Internet Connection Sharing (ICS) service across multiple supported versions of Microsoft Windows. An unauthenticated attacker on an adjacent or reachable network can send crafted traffic to a system running the ICS service, causing the service to become unavailable. The flaw is associated with a heap-based buffer issue [CWE-122] in the ICS component. Microsoft addressed the vulnerability in its February 2024 security updates.
Critical Impact
Successful exploitation disrupts the Internet Connection Sharing service, removing shared network connectivity for downstream clients that depend on the affected host for routing or NAT services.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-02-13 - Microsoft releases security update addressing CVE-2024-21348
- 2024-02-13 - CVE-2024-21348 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-21348
Vulnerability Analysis
The vulnerability resides in the Internet Connection Sharing (ICS) service, a Windows component that provides Network Address Translation (NAT), DHCP, and DNS proxy services to share a single internet connection with other devices on a local network. The flaw is classified under [CWE-122] as a heap-based buffer issue in how the ICS service processes incoming network traffic. An attacker can transmit a malformed packet to the ICS service to trigger the condition and force the service into an unrecoverable state.
The attack requires no authentication and no user interaction. The impact is limited to availability — the issue does not expose data confidentiality or allow modification of system integrity. According to the EPSS score of 2.176% (79.98th percentile), exploitation likelihood is moderate compared with the broader CVE population.
Root Cause
The root cause is improper handling of attacker-supplied input within the ICS service's packet processing logic, leading to a heap-based memory corruption condition. The condition terminates the service rather than yielding code execution, consistent with Microsoft's classification of the issue as denial of service.
Attack Vector
The attack vector is network-based. Because ICS is typically used on hosts that act as gateways for other clients, exposure is greatest where ICS is intentionally enabled — small office, lab, or tethering scenarios. An attacker reachable on a network segment served by ICS can craft and deliver packets to the listening service to trigger the fault. Hosts that do not have ICS enabled are not exposed to this specific code path.
No verified public proof-of-concept is available for CVE-2024-21348.
Refer to the Microsoft Security Response Center advisory for technical details:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21348
Detection Methods for CVE-2024-21348
Indicators of Compromise
- Unexpected termination or repeated restart of the SharedAccess service (Internet Connection Sharing) in the Windows Service Control Manager event log.
- Sudden loss of NAT, DHCP, or DNS connectivity for clients that route through a Windows host providing ICS.
- Application or System event log entries indicating a crash within the ICS service process.
Detection Strategies
- Monitor Windows Event IDs 7031, 7034, and 7036 for SharedAccess service stop or recovery events.
- Correlate ICS service crashes with inbound network traffic captures to identify suspicious malformed packets directed at the host.
- Inventory endpoints with ICS enabled and prioritize them for telemetry collection given their elevated exposure.
Monitoring Recommendations
- Forward Windows service and crash events to a centralized SIEM for cross-host correlation.
- Alert on repeated SharedAccess failures occurring across multiple endpoints within a short interval, which may indicate a coordinated probing attempt.
- Track patch deployment state across Windows 10, Windows 11, and Windows Server systems to confirm remediation coverage.
How to Mitigate CVE-2024-21348
Immediate Actions Required
- Apply the February 2024 (or later) Microsoft cumulative security update to all affected Windows 10, Windows 11, and Windows Server systems.
- Identify all hosts with the Internet Connection Sharing service enabled and prioritize them for patching.
- Restrict network reachability to ICS-enabled hosts using host firewall rules until patching is complete.
Patch Information
Microsoft published patches for all supported affected versions through the February 13, 2024 security update cycle. Refer to the Microsoft Security Update Guide for CVE-2024-21348 for the specific KB article applicable to each Windows build.
Workarounds
- Disable the Internet Connection Sharing service (SharedAccess) on systems where shared connectivity is not required.
- Block untrusted inbound traffic to ICS-enabled hosts at the network perimeter and via the Windows Defender Firewall.
- Segment systems that must run ICS onto isolated network segments to reduce the population of potential attackers.
# Disable the Internet Connection Sharing service where not required
sc.exe config SharedAccess start= disabled
sc.exe stop SharedAccess
# Verify service status
sc.exe query SharedAccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
