External risk intelligence

Windows iSCSI Discovery Service Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-21803

The iSCSI Discovery Service is typically used within internal storage area networks (SANs) for block-level storage communication. It is not designed to be exposed to the public internet, and standard deployment practices keep these services behind internal network controls, making direct internet exposure uncommon.

Integer Overflow

Microsoft Windows 10

before 10.0.10240.19747before 10.0.14393.5717before 10.0.17763.4010before 10.0.19042.2604before 10.0.19044.2604before 10.0.19045.2604

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the Windows iSCSI Discovery Service that could allow an unauthenticated attacker to execute arbitrary code remotely. While the potential impact is severe, its exposure typically occurs within internal networks, making direct internet exploitation unlikely. The primary concern is confirming relevance and exposure within your specific environment.

Enables remote code execution on Windows.
Important for understanding internal network risks.
Confirm if this internal service is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the Windows iSCSI Discovery Service. This service is responsible for discovering iSCSI targets, which are devices that provide block-level storage over a network. If this service is accessible over a network, an unauthenticated attacker could trigger the vulnerability, potentially leading to code execution on the affected system.

No authentication required for access.
Triggered by sending network requests.
Enables unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

The Windows iSCSI Discovery Service vulnerability could allow an unauthenticated attacker to execute remote code when the service is reachable. This could lead to a complete compromise of affected systems.

System data and service behavior.
Remote code execution over the network.
Full system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Microsoft Windows systems utilizing the iSCSI Discovery Service, which is typically used for internal storage network communication and not exposed to the internet. Technical leaders and security teams should prioritize identifying any instances where this service might be inadvertently exposed externally or is deemed business-critical internally. Understanding the specific Windows versions and configurations deployed is key to accurate risk assessment and planning remediation efforts with the appropriate system owners.

Identify internal or exposed iSCSI services.
Verify reachability and business criticality.
Coordinate remediation with system owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows iSCSI Discovery Service?

It is a Windows component that helps computers find and connect to iSCSI targets, which are remote storage devices accessed over a network as if they were local hard drives. It acts as a bridge for block-level storage communication within enterprise environments, allowing servers to mount storage resources across a network instead of relying solely on physical disk drives attached directly to the machine.

What does CVE-2023-21803 mean by integer overflow?

This CVE involves an integer overflow vulnerability, classified as CWE-190. In simple terms, the service attempts to store a value that is too large for its assigned memory space. When this calculation fails, it can cause the software to behave unexpectedly, potentially allowing an attacker to manipulate the program's execution flow and run their own unauthorized code on the system.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the iSCSI Discovery Service over the network. Because the service does not require authentication to process these discovery requests, no login credentials are needed. Crucially, this bug is not triggered by standard user interactions or local file access; it specifically requires network-level communication with the service itself.

Is my system at high risk for CVE-2023-21803?

Halo Surface Signal indicates that while the vulnerability is critical, the service is typically intended for isolated, internal storage area networks. Because it is not designed for public internet exposure, your actual risk depends heavily on whether this service has been inadvertently placed on an internet-facing network path or kept behind standard internal security controls.

What is the first step to address this risk?

Start by identifying all Windows systems in your environment that are currently running the iSCSI Discovery Service. Once identified, verify their network reachability to ensure they are not exposed externally. Coordinate with your infrastructure teams to confirm that these systems remain restricted to internal, protected storage networks and review the vendor’s guidance for the necessary security updates.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21803

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.