CVE-2023-35297
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected Windows systems by sending specially crafted PGM (Pragmatic General Multicast) protocol packets. It affects Windows systems with the PGM feature enabled, primarily servers using Windows Server editions. Attackers can exploit this without authentication to gain SYSTEM-level privileges.
💻 Affected Systems
- Windows Server
- Windows Client
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges leading to data theft, ransomware deployment, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to initial foothold in enterprise networks, credential harvesting, and deployment of additional malware payloads.
If Mitigated
Blocked exploitation attempts with no impact due to proper network segmentation, disabled PGM, or patched systems.
🎯 Exploit Status
Exploitation requires sending specially crafted PGM packets to vulnerable systems. No authentication needed, but attacker must reach systems with PGM enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: July 2023 security updates (KB5028166 for Windows 11, KB5028168 for Windows 10, etc.)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35297
Restart Required: Yes
Instructions:
1. Apply July 2023 Windows security updates via Windows Update. 2. For enterprise: Deploy updates through WSUS, SCCM, or Intune. 3. Verify installation via winver or systeminfo. 4. Restart systems as required.
🔧 Temporary Workarounds
Disable PGM Protocol
windowsDisables the Pragmatic General Multicast protocol to prevent exploitation.
netsh int ipv4 set global multicastforwarding=disabled
netsh int ipv6 set global multicastforwarding=disabled
Block PGM Ports
allBlock PGM traffic at network perimeter and internal segmentation.
Firewall rule: Block UDP port 3010-3012 (PGM standard ports)
🧯 If You Can't Patch
- Disable PGM protocol on all affected systems using netsh commands.
- Implement network segmentation to isolate systems with PGM enabled and block PGM traffic at firewalls.
🔍 How to Verify
Check if Vulnerable:
Check if PGM is enabled: netsh int ipv4 show global | findstr multicastforwardingCheck Version:
winver or systeminfoVerify Fix Applied:
Verify July 2023 security updates are installed: systeminfo | findstr "KB502816"📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4688 (process creation) from unexpected PGM-related processes
- Application crashes related to mswsock.dll or ws2_32.dll
Network Indicators:
- Unusual PGM traffic patterns, especially to UDP ports 3010-3012
- PGM packets with malformed headers or unexpected payloads
SIEM Query:
EventID=4688 AND (ProcessName="cmd.exe" OR ProcessName="powershell.exe") AND ParentProcessName contains "pgm"