CVE-2022-23718: 
Ping Identity PingID for Windows vulnerability analysis and mitigation

PingID Windows Login prior to version 2.8 contained a critical vulnerability that could lead to remote code execution. The vulnerability, identified as CVE-2022-23718, was discovered and assigned on January 19, 2022. The issue stems from the use of known vulnerable components in the PingID Windows Login application that could potentially be exploited to execute code with SYSTEM privileges (CVE Mitre).

The vulnerability has been assessed with a high attack complexity rating, requiring network access for exploitation. The attack vector is classified as network-based, indicating the vulnerability is exploitable remotely. The severity of this vulnerability is heightened by the potential for code execution with SYSTEM level privileges (NVD Report).

If successfully exploited, the vulnerability allows attackers who can achieve a sophisticated man-in-the-middle position or compromise Ping Identity web servers to deliver and execute malicious code with SYSTEM level privileges on affected systems (NVD).

The vulnerability requires a sophisticated man-in-the-middle position or compromise of Ping Identity web servers to be exploited. The attack complexity is rated as high, suggesting that specific conditions and considerable skill would be required for successful exploitation (NVD Report).

The vulnerability has been addressed in PingID Windows Login version 2.8 and later. Organizations using affected versions should upgrade to the latest version available through the official Ping Identity download portal (Ping Downloads).