CVE-2024-26230: Windows Telephony Service – It’s Got Some Call-ing Issues (Elevation of Privilege)

The recently disclosed vulnerability, CVE-2024-26230, affects the Windows Telephony Service and could allow attackers to escalate privileges on a compromised system. This flaw highlights the importance of securing telephony services, which are often overlooked in enterprise environments. The vulnerability stems from improper handling of certain system calls, enabling malicious actors to exploit the service and gain elevated access.

You Should Know:

To understand and mitigate this vulnerability, it’s crucial to dive into the technical details and explore practical steps to secure your systems. Below are verified commands, codes, and steps to help you address this issue:

1. Identify the Vulnerable Service:

• Use the following PowerShell command to check if the Telephony service is running:

  Get-Service -Name "TapiSrv"
  

• If the service is running, ensure it’s updated to the latest version.

2. Apply the Latest Patches:

• Microsoft has released a security update to address this vulnerability. Ensure your system is updated by running:

  wuauclt /detectnow /updatenow
  

• Alternatively, use Windows Update settings to manually check for updates.

3. Disable the Telephony Service (if not needed):

• If the Telephony service is not required, disable it to reduce the attack surface:

  Stop-Service -Name "TapiSrv"
  Set-Service -Name "TapiSrv" -StartupType Disabled
  

4. Monitor for Exploitation Attempts:

• Use Windows Event Viewer to monitor logs for suspicious activity related to the Telephony service:

  eventvwr.msc
  

• Look for Event ID 4697 (Service Installed) or unexpected service modifications.

5. Implement Network Segmentation:

• Restrict access to systems running the Telephony service by implementing network segmentation. Use firewall rules to limit access:

  New-NetFirewallRule -DisplayName "Block Telephony Service" -Direction Inbound -LocalPort 5060,5061 -Protocol TCP -Action Block
  

6. Test for Vulnerability:

• Use a vulnerability scanner like Nessus or OpenVAS to check if your system is affected by CVE-2024-26230. Run the scan with the following command (if using OpenVAS):

  openvasmd --rebuild
  openvas-scanner --scan-start <target-ip>
  

7. Enable Auditing:

• Enable auditing for service changes to detect unauthorized modifications:

  auditpol /set /subcategory:"Service Configuration Change" /success:enable /failure:enable
  

8. Use Sysinternals Tools:

• Utilize Sysinternals tools like Process Monitor to analyze Telephony service behavior:

  procmon.exe /AcceptEula
  

What Undercode Say:

CVE-2024-26230 is a critical vulnerability that underscores the importance of securing telephony services in Windows environments. By applying patches, disabling unnecessary services, and monitoring for suspicious activity, you can significantly reduce the risk of exploitation. Additionally, leveraging tools like PowerShell, OpenVAS, and Sysinternals can help you stay ahead of potential threats. Always prioritize proactive security measures to safeguard your systems.

Expected Output:

• Patched and secure Windows systems.
• Disabled or restricted Telephony service.
• Enhanced monitoring and auditing for service-related changes.
• Reduced attack surface through network segmentation and firewall rules.

References:

Reported By: Florian Hansemann – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram