CVE-2022-21972

What it actually does

CVE-2022-21972 is a remote code execution vulnerability in the Windows Point-to-Point Tunneling Protocol implementation. An unauthenticated network attacker can send specially crafted PPTP traffic to a vulnerable Windows system, typically one exposing PPTP VPN/Routing and Remote Access functionality, and potentially cause attacker-controlled code to execute with the privileges of the affected Windows service. The CVSS vector indicates network reachability, no authentication or user interaction, high confidentiality/integrity/availability impact, but high attack complexity, meaning exploitation likely depends on specific protocol state, timing, or configuration conditions.

Why it matters to the business

Successful exploitation could allow an external attacker to compromise a Windows VPN or remote-access server, which may provide a foothold into internal networks, enable credential theft, disrupt remote connectivity, or support lateral movement. Because affected products include many Windows client and server releases and the EPSS score is high, organizations that still expose PPTP services should treat this as a meaningful risk even though it is not currently listed in CISA KEV and there is no confirmed ransomware association in the provided data.

How an attack unfolds

An attacker first identifies Windows systems reachable over PPTP, usually by finding TCP port 1723 and GRE protocol 47 exposure. They then initiate or manipulate a PPTP control session and deliver malformed or crafted protocol messages intended to trigger the vulnerable code path in the Windows PPTP/RRAS handling logic. If the required state and complexity conditions are met, the vulnerable service may corrupt memory or otherwise mishandle the crafted input, allowing code execution in the service context. After code execution, the attacker would typically deploy a payload, establish persistence, inspect credentials or VPN-related secrets, and pivot from the remote-access server toward internal systems.

How to fix it

Apply the applicable Microsoft security updates released for this vulnerability as part of the May 2022 Patch Tuesday or any later cumulative update for the affected Windows version. Because fixed_versions were not provided, validate remediation by confirming the affected Windows release has current cumulative security updates installed. If PPTP is not required, disable PPTP and Routing and Remote Access exposure entirely. Prefer modern VPN protocols such as IKEv2, SSTP, or SSL/TLS-based VPN solutions where possible. Restrict TCP/1723 and GRE protocol 47 at firewalls and perimeter controls so only authorized VPN clients or trusted networks can reach PPTP endpoints. Where immediate patching is not possible, remove external exposure, disable the RRAS/PPTP role, and monitor for abnormal PPTP connection attempts and service crashes.

How to confirm the fix worked

Confirm the host has installed Microsoft updates from May 2022 or later that apply to its Windows version. Use Windows Update history, enterprise patch management reporting, or commands such as `Get-HotFix` and cumulative update inventory checks to verify patch currency. Confirm whether PPTP/RRAS is enabled by reviewing Windows Roles/Features, the Routing and Remote Access console, relevant services such as RemoteAccess and RasMan, and firewall exposure. From a controlled scanner, verify that TCP/1723 and GRE protocol 47 are not internet-exposed unless explicitly required. If PPTP must remain enabled, confirm access controls limit reachability and that monitoring is in place for PPTP connection failures, malformed traffic, and service instability.

Typical attack path

1. Scan the internet or target network for hosts exposing PPTP, especially TCP/1723 and GRE protocol 47.
2. Fingerprint the target as a Windows PPTP/RRAS endpoint or Windows system accepting PPTP traffic.
3. Establish a PPTP control connection and drive the protocol into the required vulnerable state.
4. Send crafted PPTP packets designed to trigger the remote code execution flaw.
5. Execute code in the context of the vulnerable Windows service if exploitation succeeds.
6. Deploy post-exploitation tooling, collect credentials or configuration data, and attempt lateral movement from the compromised host.

How to detect it

To determine whether exploitation may already have occurred, review network telemetry for inbound PPTP activity to Windows systems, especially TCP/1723 connections paired with GRE protocol 47 from unfamiliar external IP addresses. Examine Windows System, Security, Application, RemoteAccess, RasMan, and RRAS-related logs for unusual PPTP negotiation failures, repeated connection attempts, service crashes, or unexpected restarts around the same time as inbound PPTP traffic. Look for Service Control Manager events showing the Remote Access Connection Manager, Routing and Remote Access, or related svchost-hosted services terminating unexpectedly. Review crash dumps, Windows Error Reporting artifacts, and endpoint detection telemetry for faults in VPN/RAS components followed by suspicious process creation, new services, scheduled tasks, credential dumping behavior, or outbound command-and-control connections. Because no public exploit maturity is indicated in the input, detections should focus on exposure, anomalous PPTP traffic, crash-correlated events, and post-exploitation behavior rather than a single known exploit signature.

• TCP/1723
• ip_proto=47
• protocol=GRE
• PPTP
• RasMan
• RemoteAccess
• Routing and Remote Access
• Remote Access Connection Manager
• The Remote Access Connection Manager service terminated unexpectedly
• The Routing and Remote Access service terminated unexpectedly
• Service Control Manager Event ID 7031
• Service Control Manager Event ID 7034
• svchost.exe
• Microsoft-Windows-RasClient
• RemoteAccess/Operational
• RasMan/Operational

What your security team should do

• Prioritize patching Windows servers that expose PPTP, RRAS, or VPN services to untrusted networks.
• Identify and inventory all systems listening on TCP/1723 or allowing GRE protocol 47, especially internet-facing assets.
• Disable PPTP where possible and migrate users to stronger, supported VPN protocols.
• Restrict PPTP access with perimeter firewalls, VPN allowlists, or network segmentation until patching and protocol migration are complete.
• Review historical logs for unusual PPTP connection attempts, repeated failures, and crashes of RasMan, RemoteAccess, or RRAS-related services.
• Add network detections for unexpected inbound TCP/1723 and GRE traffic, particularly from unfamiliar geographies, hosting providers, or high-volume scanners.
• Treat unexplained RRAS/RasMan crashes on unpatched systems as potentially suspicious and perform endpoint triage.
• Maintain current Windows cumulative updates across legacy Windows client and server versions still in operation.