Cyber Posture

CVE-2025-21297

High

Published: 14 January 2025

Published
14 January 2025
Modified
24 January 2025
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0171 82.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Windows Remote Desktop Services Remote Code Execution Vulnerability

Security Summary

CVE-2025-21297 is a Remote Code Execution vulnerability affecting Windows Remote Desktop Services. Published on 2025-01-14, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-416, with additional NVD-CWE-noinfo classification.

The vulnerability can be exploited by a remote unauthenticated attacker over the network, requiring no user interaction but high attack complexity. Successful exploitation grants high-impact remote code execution, compromising confidentiality, integrity, and availability on the targeted system.

Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21297 provides guidance on mitigation and patching for this vulnerability.

Details

CWE(s)
CWE-416NVD-CWE-noinfo

Affected Products

microsoft
windows server 2008
r2
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.7699
microsoft
windows server 2019
≤ 10.0.17763.6775
microsoft
windows server 2022
≤ 10.0.20348.3091
microsoft
windows server 2022 23h2
≤ 10.0.25398.1369
microsoft
windows server 2025
≤ 10.0.26100.2894

References