Skip to main content
IT SupportOutreach

Windows Update KB5009543, KB5009566 breaks L2TP VPN connections

By January 13, 2022January 23rd, 2022No Comments

01-23-2022 | We have published an update to this post Windows Update KB5009543, KB5009566 breaks L2TP VPN connections (Update) – Boston Managed IT (bostonmit.com)

Windows 10 users and administrators report problems making L2TP VPN connections after installing the recent Windows 10 KB5009543 and Windows 11 KB5009566 cumulative updates.

Yesterday, Microsoft released Windows updates to fix security vulnerabilities and bugs as part of the January 2022 Patch Tuesday.

These updates include KB5009566 for Windows 11 and KB5009543 for Windows 10 2004, 20H1, and 21H1.

Updates break L2TP connections

After installing yesterday’s updates, Windows users find their L2TP VPN connections broken when attempting to connect using the Windows VPN client.

When attempting to connect to a VPN device, they are shown an error stating, “Can’t connect to VPN. The L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer,” as shown below.

Windows error when connecting to an LT2P VPN
Windows error when connecting to an LT2P VPN

The Event Log will also log entries with error code 789, stating that the connection to the VPN failed.

Windows event log for failed L2TP VPN connection
Windows event log for failed L2TP VPN connection

The bug is not affecting all VPN devices and seems only to be affecting users using the built-in Windows VPN client to make the connection.

A security researcher known as Ronny on Twitter told BleepingComputer that the bug affects their Ubiquiti Client-to-Site VPN connections for those using the Windows VPN client.

Many Windows admins also report on Reddit that the bug also affects connections to SonicWall, Cisco Meraki, and WatchGuard Firewalls, with the latter’s client also affected by the bug.

With many users still working remotely, admins have been forced to remove the KB5009566 and KB5009543 updates, which immediately fixes the L2TP VPN connections on reboot.

FIX

Windows users can remove the KB5009566 and KB5009543 updates using the following commands from an Elevated Command Prompt.

Windows 10: wusa /uninstall /kb:5009543
Windows 11: wusa /uninstall /kb:5009566

However, as Microsoft bundles all security updates in a single Windows cumulative update, removing the update will remove all fixes for vulnerabilities patched during the January Patch Tuesday. 

Therefore, Windows admins need to weigh the risks of unpatched vulnerabilities versus the disruption caused by the inability to connect to VPN connections.

It is not clear what caused the bug, but Microsoft’s January Patch Tuesday fixed numerous vulnerabilities in the Windows Internet Key Exchange (IKE) protocol (CVE-2022-21843, CVE-2022-21890, CVE-2022-21883, CVE-2022-21889, CVE-2022-21848, and CVE-2022-21849) and in the Windows Remote Access Connection Manager (CVE-2022-21914 and CVE-2022-21885) that could be causing the problems.

As always, if you need help with these kinds of issue, please reach out by email at [email protected] or by phone at 617-322-5155. You can also contact us by web at https://www.bostonmit.com/contact/

 

Tags:

Nicholas Salem

Nicholas Salem

As the CEO of BMIT, a leading managed IT services company, Nick Salem is responsible for providing strategic leadership and direction to the organization. With over 15 years of experience in the IT industry, Nick has a strong track record of driving business growth and improving operational efficiency through the use of technology.

Related Posts

IT Support

Supply Chain Attacks: Insights from the Hezbollah Pager Bombings and What Businesses Can Learn

The recent explosion of Hezbollah's pagers and walkie-talkies, believed to be the result of a supply chain attack, underscores how vulnerable organizations can be—even when using seemingly outdated technology. This attack serves as a wake-up call for both governments and businesses regarding the risks hidden in supply chains, as attackers increasingly target weaker links in an organization’s ecosystem. What Is a Supply Chain Attack? A supply chain attack occurs when an attacker infiltrates a third-party vendor, service provider, or manufacturer that a company relies on. Rather than attacking the primary target directly, cybercriminals exploit the weaker security of a supplier to insert malicious code or compromise hardware during manufacturing. When that software or hardware is distributed, the attackers gain access to the primary target’s network or critical systems. In the case of Hezbollah’s pagers, it’s believed the devices were compromised before they reached the end-users, resulting in deadly consequences when triggered. Steps in a Supply Chain Attack Compromise the Vendor: Attackers first identify and compromise…
Nicholas Salem
Nicholas SalemSeptember 20, 2024
OutreachNon-Profits

Boston Managed IT is a Proud Sponsor of A Special Day in Waltham!

we're passionate about technology and the communities we serve. That's why we're thrilled to announce our support for A Special Day in Waltham, a phenomenal event dedicated to creating inclusive experiences for Individuals with Developmental Disabilities.
Nicholas Salem
Nicholas SalemApril 23, 2024
IT SupportBusiness

How BMIT Can Save Your Small Business Money: A Comprehensive Guide

Small businesses struggling with budgets? Outsourced IT can save $$ by reducing overhead, boosting efficiency & providing access to experts.
Nicholas Salem
Nicholas SalemFebruary 27, 2024