Microsoft · Microsoft · CVE-2024-2169
**Name of the Vulnerable Software and Affected Versions**
Webmin/Virtualmin versions (affected versions not specified)
Broadcom (affected versions not specified)
Microsoft (affected versions not specified)
MikroTik (affected versions not specified)
**Description**
The issue is related to implementations of UDP application protocols being vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation, leading to Denial of Service (DOS) and/or abuse of resources. The vulnerability is associated with the possibility of spoofing attacks. It is estimated that up to 300,000 hosts are at risk, and over 517,000 results have been found. The vulnerability can be exploited by sending UDP packets with spoofed source IP and port using another Webmin instance's IP address, leading to endless traffic exchange between hosts.
**Recommendations**
As a temporary workaround, consider disabling the UDP service discovery mechanism, typically operating on port 10000, until a patch is available.
Restrict access to the vulnerable UDP application protocol implementations to minimize the risk of exploitation.
Avoid using the vulnerable Webmin/Virtualmin control panels until the issue is resolved.
Apply vendor patches, firewall rules, and anti-spoofing solutions to secure the server.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.