CVE-2024-43572
Microsoft Windows Management Console Remote Code Execution Vulnerability
Description
CVE-2024-43572 is a high-severity remote code execution vulnerability in the Microsoft Management Console (MMC), the administrative framework used throughout Windows for system configuration, monitoring, and management tasks. A local attacker can exploit this flaw by convincing a user to open a specially crafted Microsoft Saved Console (.msc) file, which triggers arbitrary code execution in the context of the targeted user. With a CVSS v3.1 base score of 7.8 and all three impact metrics rated high, the vulnerability affects Windows 10, Windows 11, and Windows Server editions from 2008 through 2022. CISA has added CVE-2024-43572 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 29, 2024, and the EPSS score of 44.59% at the 97.5th percentile signals aggressive exploitation by threat actors worldwide.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20796 |
| microsoft | windows 10 1607 | < 10.0.14393.7428 |
| microsoft | windows 10 1809 | < 10.0.17763.6414 |
| microsoft | windows 10 21h2 | < 10.0.19044.5011 |
| microsoft | windows 10 22h2 | < 10.0.19045.5011 |
| microsoft | windows 11 21h2 | < 10.0.22000.3260 |
| microsoft | windows 11 22h2 | < 10.0.22621.4317 |
| microsoft | windows 11 23h2 | < 10.0.22631.4317 |
| microsoft | windows 11 24h2 | < 10.0.26100.2033 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7428 |
| microsoft | windows server 2019 | < 10.0.17763.6414 |
| microsoft | windows server 2022 | < 10.0.20348.2762 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1189 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43572(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43572(US Government Resource)
Weakness Type
Remote Code Execution via Malicious MSC Files
CVE-2024-43572 is a remote code execution vulnerability in the Microsoft Management Console that stems from improper handling of saved console (.msc) files. MSC files are XML-based configuration files that define MMC snap-in layouts, configurations, and associated actions. The vulnerability arises because the MMC fails to properly validate the contents of these files before processing them, allowing an attacker to embed malicious payloads that execute when the file is opened. This is particularly dangerous because MSC files are commonly used by system administrators and are often trusted by default in enterprise environments, making social engineering attacks highly effective.
Impact Analysis
Confidentiality is fully compromised when CVE-2024-43572 is successfully exploited. Once an attacker achieves code execution through a malicious MSC file, they gain access to all data accessible by the targeted user, which in the case of system administrators using MMC can include domain credentials, security configurations, and sensitive management data. The local attack vector (AV:L) means the malicious file must be delivered to the target machine, but this is commonly achieved through email attachments, shared drives, or compromised download locations.
Integrity faces maximum impact as the attacker can execute arbitrary code, modify system configurations, install persistent backdoors, tamper with security settings managed through MMC snap-ins, and alter audit logs. Since MMC is a privileged management tool, exploitation can lead to full system compromise, particularly when the victim runs with administrative privileges.
Availability is also fully impacted because the attacker can disrupt services, corrupt system configurations, or deploy destructive payloads. The EPSS score of 44.59% at the 97.5th percentile is exceptionally high, placing this vulnerability in the top 2.5% of all CVEs for exploitation probability. While the ransomware association remains unknown according to CISA, the combination of local code execution and the administrative nature of MMC makes this an ideal entry point for ransomware operators targeting enterprise environments.
Exploit Maturity
CVE-2024-43572 exhibits a very high level of exploit maturity, confirmed by its presence in CISA's Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 29, 2024. The EPSS score of 44.59% at the 97.5th percentile places it among the most actively targeted vulnerabilities, indicating widespread exploitation campaigns.
Microsoft has released security updates documented in the Microsoft Security Response Center advisory. The attack leverages malicious MSC files, which are familiar to Windows administrators and often not flagged as suspicious by basic security tools. The user interaction requirement (UI:R) is the primary barrier to exploitation, but targeted phishing campaigns can overcome this effectively, especially when MSC files are sent in contexts where administrators expect to receive management console configurations. The vulnerability's broad impact across Windows desktop and server versions from 2008 through 2022 maximizes the potential attack surface. Although CISA lists the ransomware association as unknown, the ability to achieve arbitrary code execution on administrative workstations through a trusted file format makes this vulnerability a prime candidate for initial access in ransomware and advanced persistent threat campaigns.
Remediation
-
Install the October 2024 Windows security updates immediately. Apply the patches provided by Microsoft through the Security Update Guide for CVE-2024-43572. This update addresses the vulnerability across all affected Windows versions including legacy Server 2008 and 2012 editions.
-
Block untrusted MSC files at the email and web gateway. Configure email security solutions to quarantine or strip MSC file attachments from incoming messages. Implement web content filtering to block downloads of MSC files from external or untrusted sources. Many organizations have no legitimate business need to receive MSC files from external parties.
-
Restrict MSC file execution through Group Policy. Use Windows Software Restriction Policies or AppLocker to control which MSC files are permitted to execute. Limit MSC file execution to signed files from trusted publishers and restrict execution paths to known management tool directories.
-
Apply the principle of least privilege for MMC usage. Ensure administrators do not routinely operate with domain administrator or local administrator privileges when performing tasks that do not require elevated access. Use separate administrative workstations (PAWs) for management tasks to limit the impact of exploitation.
-
Monitor for suspicious MSC file activity. Deploy endpoint detection rules to alert on MSC files opened from unusual locations such as temp directories, user download folders, or email cache directories. Track mmc.exe process creation events and correlate them with the parent process and file origin to identify exploitation attempts.
Technical Details
CVE-2024-43572 carries a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yielding a base score of 7.8 (High). The local attack vector (AV:L) indicates that the attacker must deliver the malicious file to the target system, while low complexity (AC:L) means no special conditions need to be met beyond file delivery. No privileges are required (PR:N) on the target system, but user interaction (UI:R) is necessary as the victim must open the crafted MSC file.
The Microsoft Management Console (mmc.exe) is a framework application that hosts administrative tools called snap-ins, such as Device Manager, Disk Management, Group Policy Editor, and Event Viewer. These tools are configured through MSC (Microsoft Saved Console) files, which are XML documents defining the snap-in layout and configuration. The vulnerability exists in how MMC parses and processes the contents of MSC files, where a maliciously crafted file can trigger code execution during the loading phase. The attacker can embed payloads that exploit the trust relationship between MMC and its snap-in architecture, causing arbitrary code to execute with the privileges of the user who opened the file.
All three impact metrics are rated high (C:H/I:H/A:H), reflecting the full compromise potential of arbitrary code execution. The scope is unchanged (S:U), meaning the vulnerability directly impacts the MMC process and the user's session. The affected product range is exceptionally broad, spanning from Windows Server 2008 and 2012 (which are past end-of-life but still in extended security updates) through the latest Windows 11 24H2 and Windows Server 2022 23H2 releases, indicating a fundamental flaw in the core MMC component that has persisted across many years of Windows development.
Frequently Asked Questions
What is CVE-2024-43572?
CVE-2024-43572 is a remote code execution vulnerability in the Microsoft Management Console (MMC). An attacker can create a specially crafted MSC file that, when opened by a victim, executes arbitrary code on their system. The vulnerability has a CVSS score of 7.8 and is actively exploited in the wild.
How would an attacker exploit this vulnerability?
The attacker creates a malicious MSC (Microsoft Saved Console) file and delivers it to the target through phishing emails, shared network drives, or compromised websites. When the victim opens the file, MMC processes its contents and triggers code execution. Since MSC files are legitimate administrative tools, they may not be flagged as suspicious by basic security measures.
Are Windows Server systems affected by CVE-2024-43572?
Yes. CVE-2024-43572 affects all Windows Server versions from 2008 through 2022 23H2, in addition to Windows 10 and Windows 11 desktop editions. Server environments are particularly at risk because system administrators regularly use MMC and MSC files for server management tasks.
What did Microsoft's patch change?
Microsoft's October 2024 security update addresses how the Management Console validates and processes MSC file contents. After patching, MMC properly restricts the actions that can be triggered through MSC files, preventing the malicious code execution pathway that attackers were exploiting.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.