CVE-2022-35744
📋 TL;DR
CVE-2022-35744 is a critical remote code execution vulnerability in Windows Point-to-Point Protocol (PPP) that allows unauthenticated attackers to execute arbitrary code on affected systems. This affects Windows servers and workstations with PPP enabled, potentially allowing complete system compromise. The vulnerability is particularly dangerous because it can be exploited without user interaction.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 20h2 by Microsoft
Windows 10 20h2 by Microsoft
Windows 10 20h2 by Microsoft
Windows 10 21h1 by Microsoft
Windows 10 21h1 by Microsoft
Windows 10 21h1 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with administrative privileges, enabling data theft, ransomware deployment, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to malware installation, credential harvesting, and system compromise for further network exploitation.
If Mitigated
Limited impact with proper network segmentation, firewall rules blocking PPP ports, and endpoint protection detecting exploitation attempts.
🎯 Exploit Status
Microsoft has rated this as 'Exploitation More Likely' in their security advisory. The vulnerability requires no user interaction and can be exploited remotely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: August 2022 security updates (KB5016616, KB5016623, etc.)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35744
Restart Required: Yes
Instructions:
1. Apply August 2022 Windows security updates from Windows Update. 2. For enterprise environments, deploy updates via WSUS, SCCM, or Intune. 3. Restart affected systems after patch installation.
🔧 Temporary Workarounds
Disable PPP Service
windowsDisable the Point-to-Point Protocol service if not required for business operations.
sc config RasMan start= disabled
sc stop RasMan
Block PPP Ports
allConfigure firewalls to block PPP-related ports (TCP 1723, GRE protocol 47) from untrusted networks.
🧯 If You Can't Patch
- Disable PPP/RAS services on all affected systems immediately
- Implement strict network segmentation and firewall rules to isolate systems with PPP enabled
🔍 How to Verify
Check if Vulnerable:
Check if PPP/RAS services are running: 'sc query RasMan' or 'Get-Service RasMan' in PowerShell. If service is running and system is unpatched, it's vulnerable.Check Version:
wmic os get caption,version,buildnumber,csdversionVerify Fix Applied:
Verify August 2022 security updates are installed: 'systeminfo | findstr /B /C:"OS Name" /C:"OS Version"' and check for KB5016616 or later patches.📡 Detection & Monitoring
Log Indicators:
- Event ID 20209 in RemoteAccess logs
- Unexpected PPP connection attempts
- RasMan service crashes or unexpected restarts
Network Indicators:
- Unusual PPP traffic patterns
- Connection attempts to TCP port 1723 from unexpected sources
- GRE protocol traffic anomalies
SIEM Query:
source="*RemoteAccess*" AND (EventID=20209 OR "RasMan" OR "PPP")