CVE-2022-23253: Windows PPTP denial of service via crafted packets

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw is a network-reachable availability issue requiring low privileges, with no confirmed exploitation but a high EPSS score.

What it is

CVE-2022-23253 is a denial of service flaw in the Windows Point-to-Point Tunneling Protocol (PPTP) implementation. A remote attacker who can reach the PPTP service can send crafted traffic that disrupts the service, and the record gives no further detail on the exact mechanism. It matters because PPTP is still deployed on many Windows versions, including legacy and server releases, and a successful attack degrades or halts remote access over that protocol.

Impact

An attacker can cause a denial of service against the affected Windows PPTP service, interrupting VPN or remote access connectivity for users relying on it. The CVSS vector shows no confidentiality or integrity impact, so the effect is availability only.

Attack surface

The vector is network-reachable (AV:N) with low attack complexity and no user interaction, but it requires low privileges (PR:L), meaning the attacker needs some valid access or foothold before triggering the flaw. No details on the specific packet or port handling are provided in the record.

Exploitation

The record shows no CISA KEV listing and no reference tags indicating public exploit code, so there is no confirmed in-the-wild exploitation. EPSS is high (0.56376, 99th percentile), suggesting elevated likelihood of exploitation activity, but this is a statistical estimate, not evidence of a working exploit.

What to do

• Apply the Microsoft security update for CVE-2022-23253 as the first action.
• Disable or block PPTP where it is not required, since PPTP is a legacy protocol with known weaknesses.
• Restrict network access to PPTP ports to trusted hosts and networks.
• Monitor and limit low-privileged accounts that can reach PPTP services.
• Retire unsupported Windows versions listed as affected where feasible.

Detection

• Monitor Windows event logs for PPTP or Remote Access Service crashes, restarts, or unexpected service termination.
• Alert on spikes in PPTP connection attempts or malformed PPTP traffic from low-privileged or unusual sources.
• Track availability of PPTP endpoints and investigate unexplained outages.
• Review firewall and network logs for PPTP traffic from hosts that do not normally use it.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.