Man-in-the-Middle (MitM) attack in Microsoft Endpoint Configuration Manager - CVE-2022-37972

Detailed vulnerability description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the way Microsoft Endpoint Configuration Manager handles Kerberos authentication failures. The application attempts to use NTLM to authenticate even if disabled by the "Allow connection fallback to NTLM" option. A remote attacker can perform spoofing attack and extract victims credentials via NTLM connection.

How to mitigate CVE-2022-37972

Sources

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37972
• https://learn.microsoft.com/en-us/mem/configmgr/hotfix/2207/15498768