Windows Wired AutoConfig CVE-2026-62730

Exploitation requires an already-established local user session on the target Windows host with at minimum standard (low-privilege) user rights - consistent with CVSS PR:L. The attacker must be able to interact with the Wired AutoConfig Service (dot3svc); this service is present by default on Windows systems but may be stopped or disabled on servers not using 802.1X wired authentication. No network-reachable attack path exists (AV:L). Exploitation is not automatable per SSVC, meaning mass-scanning or worm-style propagation is not a realistic threat model. Limiting factors include: requirement for prior local access (rules out remote unauthenticated attackers), no user interaction needed once local access is achieved, and impact confined to information disclosure with no integrity or availability consequence.

The CVSS 5.5 Medium score is grounded in realistic metrics: AV:L (requires physical or already-established local session), AC:L (no complex preconditions once local), PR:L (standard user privilege suffices), and C:H (high confidentiality impact from memory disclosure). SSVC reinforces measured urgency - exploitation is rated none, the vulnerability is not automatable (eliminating mass-scan scenarios), and technical impact is partial. The absence of a KEV listing and no reported POC code further reduce immediacy. EPSS data was not provided; however, given SSVC exploitation:none and no POC, probability of near-term weaponization appears low. The primary real-world risk lies in post-compromise lateral movement or privilege escalation chains where an attacker already holding a foothold user account leverages the memory disclosure to harvest credentials or session tokens from the AutoConfig service's memory space - even a mid-sized municipal IT team in tczew should treat this as standard Patch Tuesday remediation rather than an out-of-band emergency. The CVSS confidentiality:high rating is the most notable signal: if sensitive authentication material (802.1X credentials, certificates) transits the service's memory, disclosure could be more impactful than the base score implies.

An attacker who has already obtained a low-privilege local user account on a target Windows system - through credential phishing, a prior exploit, or insider access - invokes the Wired AutoConfig Service's IPC interface with a crafted request that triggers the buffer over-read, causing the service to return memory contents beyond the intended buffer. If the adjacent memory region contains authentication tokens, 802.1X credentials, or other sensitive data held by the service, the attacker can read and exfiltrate that material to facilitate further lateral movement. No public POC exists at time of analysis, so exploitation currently requires independent vulnerability research to reproduce.