CVE-2023-21689 · Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

According to the CVSS metric, the attack vector is network (AV:N), privilege required is none (PR:N), and user interaction is none (UI:N). What is the target used in the context of the remote code execution? The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution and attempt to trigger malicious code in the context of the server's account through a network call. The attacker needs no privileges nor does the user need to perform any action.

Microsoft Protected Extensible Authentication Protocol (PEAP) is only negotiated with the client if NPS is running on the Windows Server and has a network policy configured that allows PEAP. To stop using PEAP, customers should ensure that PEAP Type is not configured as an allowed EAP type in their network policy. To learn more, please see Configure the New Wireless Network Policy and Configure Network Policies