PT-2024-2233 · Microsoft+3 · Microsoft+3

Alexander Chernenkov + 2 · Published 2024-03-19 · Updated 2025-10-27 · CVE-2024-2169

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Webmin/Virtualmin versions (affected versions not specified) Broadcom (affected versions not specified) Microsoft (affected versions not specified) MikroTik (affected versions not specified)

Description The issue is related to implementations of UDP application protocols being vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation, leading to Denial of Service (DOS) and/or abuse of resources. The vulnerability is associated with the possibility of spoofing attacks. It is estimated that up to 300,000 hosts are at risk, and over 517,000 results have been found. The vulnerability can be exploited by sending UDP packets with spoofed source IP and port using another Webmin instance's IP address, leading to endless traffic exchange between hosts.

Recommendations As a temporary workaround, consider disabling the UDP service discovery mechanism, typically operating on port 10000, until a patch is available. Restrict access to the vulnerable UDP application protocol implementations to minimize the risk of exploitation. Avoid using the vulnerable Webmin/Virtualmin control panels until the issue is resolved. Apply vendor patches, firewall rules, and anti-spoofing solutions to secure the server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-406

Related Identifiers

BDU:2024-02164

CVE-2024-2169

MGASA-2024-0290

Affected Products

Broadcom

Microsoft

Mikrotik

Red Os

References · 42

• 🔥 https://github.com/douglasbuzatto/G3-Loop-DoS · Exploit
• https://osv.dev/vulnerability/MGASA-2024-0290 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02164 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-2169 · Security Note
• https://advisories.mageia.org/MGASA-2024-0290.html · Security Note
• https://twitter.com/CeptBiro/status/1832058127211983261 · Twitter Post
• https://twitter.com/milankowww/status/1772716901627515295 · Twitter Post
• https://kb.cert.org/vuls/id/417980 · Note
• https://twitter.com/fofabot/status/1831604615030468965 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-webmin-cve-2024-2169 · Note
• https://mobile.opennet.ru/opennews/art.shtml?num=60814 · Note
• https://docs.google.com/document/d/1KByZzrdwQhrXGPPCf9tUzERZyRzg0xOpGbWoDURZxTI/edit · Note
• https://t.me/echeloneyes/2579 · Telegram Post
• https://twitter.com/Dinosn/status/1831540904416424367 · Twitter Post
• https://twitter.com/RedPacketSec/status/1771841411341504852 · Twitter Post