CVE-2024-21348: 
vulnerability analysis and mitigation

Internet Connection Sharing (ICS) Denial of Service Vulnerability (CVE-2024-21348) was disclosed on February 13, 2024, affecting various versions of Microsoft Windows operating systems. This vulnerability was initially identified and reported by Microsoft Corporation, impacting multiple Windows versions including Windows 10, Windows 11, and Windows Server editions (Microsoft Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can result in high availability impact. Microsoft has classified this as a heap-based buffer overflow vulnerability (CWE-122) (NVD).

The vulnerability primarily affects the availability of the system through the Internet Connection Sharing (ICS) service. When successfully exploited, it can lead to a denial of service condition, potentially disrupting network connectivity and system operations (Microsoft Advisory).

Microsoft has released security updates to address this vulnerability across affected systems. Updates are available for Windows 10 (versions 1507 through 22H2), Windows 11 (21H2 through 23H2), and Windows Server versions (2012 through 2022). Users are advised to apply the relevant security patches through Windows Update or manual installation of the appropriate KB updates (Rapid7).