CVE-2023-36703
📋 TL;DR
This vulnerability in the DHCP Server Service allows an attacker to send specially crafted packets that cause a denial of service, potentially crashing the service. It affects Windows Server systems running the DHCP Server role. The vulnerability requires network access to the DHCP server.
💻 Affected Systems
- Windows Server DHCP Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete DHCP service outage, preventing new clients from obtaining IP addresses and disrupting network connectivity across the organization.
Likely Case
DHCP service becomes unresponsive, requiring manual restart and causing temporary network disruption for clients attempting to obtain or renew leases.
If Mitigated
Service automatically restarts or fails gracefully with minimal impact to existing client connections.
🎯 Exploit Status
Exploitation requires network access to the DHCP server port (UDP 67/68). No authentication is required to send DHCP packets.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: October 2023 security updates
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36703
Restart Required: Yes
Instructions:
1. Apply the October 2023 security updates from Windows Update. 2. Restart the server to complete installation. 3. Verify the DHCP service is running properly after restart.
🔧 Temporary Workarounds
Restrict DHCP Server Access
windowsUse firewall rules to limit which network segments can communicate with the DHCP server.
New-NetFirewallRule -DisplayName "Restrict DHCP" -Direction Inbound -LocalPort 67,68 -Protocol UDP -RemoteAddress 192.168.1.0/24 -Action Allow
Implement DHCP Relay Protection
allConfigure network devices to filter or rate-limit DHCP traffic to the server.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate DHCP servers from untrusted networks
- Deploy redundant DHCP servers with failover configuration to maintain service during attacks
🔍 How to Verify
Check if Vulnerable:
Check if the DHCP Server role is installed and if the October 2023 security updates are not applied.Check Version:
Get-WindowsFeature -Name DHCP | Select-Object Installed, VersionVerify Fix Applied:
Verify that the October 2023 security updates are installed and the DHCP service is running version 10.0.xxxxx.xxxx or later.📡 Detection & Monitoring
Log Indicators:
- DHCP service crash events in Event Viewer (Event ID 1000, 1001)
- Multiple DHCPNAK responses to valid requests
- Service termination without normal shutdown
Network Indicators:
- Unusual volume of malformed DHCP packets to UDP port 67
- DHCPDISCOVER packets with abnormal options or lengths
SIEM Query:
EventID=1000 OR EventID=1001 AND SourceName="DhcpServer" AND Keywords="0x80000000000000"