CVE-2022-23270

What it actually does

CVE-2022-23270 is a remote code execution vulnerability in the Windows Point-to-Point Tunneling Protocol implementation. A network-based, unauthenticated attacker could send specially crafted PPTP traffic to a vulnerable Windows system running PPTP/RRAS VPN services and potentially execute code in the context of the affected service. Because PPTP is exposed over TCP/1723 and GRE protocol 47, systems offering PPTP VPN service to untrusted networks are the primary risk. The CVSS attack complexity is high, meaning exploitation likely requires precise packet sequencing, environmental conditions, or reliability work, but successful exploitation can compromise confidentiality, integrity, and availability of the affected host.

Why it matters to the business

A successful attack could give an external attacker control of a Windows VPN server or other system exposing PPTP, allowing data theft, service disruption, credential harvesting, lateral movement, or use of the VPN infrastructure as a beachhead into the internal network. The vulnerability affects many supported and legacy Windows desktop and server versions, including Windows 7, 8.1, 10, 11, and Windows Server 2008 through 2019. Although it is not listed in CISA KEV and no mature public exploit is indicated in the provided data, the EPSS score is elevated, so internet-exposed PPTP services should be treated as higher priority than ordinary backlog patching.

How an attack unfolds

An attacker first identifies Windows systems exposing PPTP, typically by finding TCP/1723 reachable from the internet and confirming GRE traffic is permitted. The attacker then sends malformed or carefully sequenced PPTP control and tunnel traffic to trigger the vulnerable code path in the Windows PPTP implementation. If exploitation succeeds, the attacker gains code execution on the target service host, most likely inside a Windows service process associated with RRAS/RemoteAccess/RAS components. From there, the attacker may deploy a payload, create persistence, dump credentials, inspect VPN configuration, pivot to internal systems, or disrupt VPN availability. Because the vulnerability has high attack complexity, failed attempts may appear as PPTP connection failures, malformed-session noise, RemoteAccess/RasMan errors, or service crashes before reliable code execution is achieved.

How to fix it

Apply the Microsoft security updates released for this vulnerability, or any later cumulative updates, to all affected Windows systems, especially Windows servers running Routing and Remote Access Service or accepting PPTP VPN connections. Where possible, disable PPTP entirely because it is legacy VPN technology and has broader security weaknesses; migrate remote access to stronger alternatives such as IKEv2/IPsec, SSTP, or other modern VPN solutions. If PPTP must remain temporarily enabled, restrict access to known source IP ranges, block TCP/1723 and GRE protocol 47 from untrusted networks, place the service behind appropriate VPN gateways or firewalls, and monitor it closely. Decommission or isolate unsupported Windows versions such as Windows 7, Windows Server 2008, and other legacy platforms if they cannot receive applicable security updates.

How to confirm the fix worked

Confirm that all affected Windows hosts have the relevant May 2022 or later cumulative security updates installed. Validate through Windows Update history, enterprise patch management inventory, PowerShell-based hotfix checks, vulnerability scanner results, or Microsoft build/KB compliance reporting. Verify that PPTP is disabled where it is not required by checking RRAS/RemoteAccess configuration and firewall rules. From an external network perspective, confirm that TCP/1723 is not reachable unless explicitly required and that GRE protocol 47 is blocked or restricted. For systems that must expose PPTP, run an authenticated vulnerability scan and verify that the scanner no longer reports CVE-2022-23270. Also confirm the RemoteAccess/RasMan services are stable after patching and that no unexplained service crashes or abnormal VPN connection attempts persist.

Typical attack path

1. Scan for hosts exposing PPTP VPN service on TCP/1723 and allowing GRE protocol 47.
2. Fingerprint the target as a Windows PPTP/RRAS service and determine whether it appears unpatched.
3. Send crafted PPTP control-channel and GRE traffic designed to trigger the vulnerable code path.
4. Achieve code execution in the context of the affected Windows networking/VPN service process.
5. Stage a payload or command execution mechanism on the compromised host.
6. Collect credentials, VPN configuration, routing information, and host reconnaissance data.
7. Move laterally from the VPN server or use it as a trusted network entry point.
8. Cover tracks by clearing or reducing VPN, service crash, and Windows event artifacts.

How to detect it

To determine whether this was already exploited, focus on Windows systems that were exposing PPTP before patching. Review perimeter firewall, VPN, and NetFlow records for inbound TCP/1723 and GRE protocol 47 from unusual or high-volume external sources, especially repeated failed sessions or malformed connection patterns. Examine Windows System, Application, Security, Microsoft-Windows-RemoteAccess, RasMan, RasClient, and RRAS-related logs for service crashes, unexpected restarts, abnormal PPTP negotiation failures, and VPN activity from unfamiliar IP addresses. Check Windows Error Reporting and crash artifacts for svchost.exe or RRAS/RemoteAccess/RasMan-related faults around suspicious connection times. Use EDR telemetry to hunt for suspicious post-exploitation behavior such as service-hosted processes spawning command shells, PowerShell, script interpreters, credential access tools, unexpected network connections, new local administrators, scheduled tasks, services, or dropped binaries. Because no exploit-specific public IOC is provided, detection should combine exposure history, anomalous PPTP traffic, service instability, and generic Windows post-compromise indicators.

• TCP/1723
• GRE protocol 47
• PPTP
• RemoteAccess
• RasMan
• RasClient
• Routing and Remote Access
• RRAS
• svchost.exe -k netsvcs
• svchost.exe -k NetworkService
• %SystemRoot%\System32\rasman.dll
• %SystemRoot%\System32\mprdim.dll
• %SystemRoot%\System32\rassrv.dll
• Microsoft-Windows-RemoteAccess
• Microsoft-Windows-RasMan
• Microsoft-Windows-RasClient
• Remote Access Connection Manager
• Routing and Remote Access service terminated unexpectedly
• The Remote Access Connection Manager service terminated unexpectedly
• The Routing and Remote Access service terminated unexpectedly

What your security team should do

• Prioritize patching internet-facing Windows systems that expose PPTP/RRAS services on TCP/1723 or GRE protocol 47.
• Inventory all PPTP usage and remove or migrate it wherever possible due to legacy protocol risk.
• Block inbound TCP/1723 and GRE protocol 47 at perimeter firewalls unless there is a documented business requirement.
• For required PPTP exposure, restrict source IP ranges and increase monitoring for malformed sessions, connection failures, and service instability.
• Review Windows event logs, RRAS logs, firewall logs, VPN logs, EDR telemetry, and crash dumps for signs of pre-patch exploitation attempts.
• Hunt for suspicious child processes, credential dumping, new users, unexpected scheduled tasks, or persistence from Windows service processes associated with RemoteAccess/RRAS.
• Ensure legacy Windows systems that cannot be patched are removed from internet exposure, segmented, or replaced.
• Track EPSS-driven prioritization: despite no KEV listing or known mature exploit in the provided data, the elevated EPSS score warrants accelerated remediation for exposed services.