Cyber Posture

CVE-2025-24045

High

Published: 11 March 2025

Published
11 March 2025
Modified
03 July 2025
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0026 49.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2025-24045 is a vulnerability in Windows Remote Desktop Services that involves sensitive data storage in improperly locked memory, as indicated by CWE-591. Published on 2025-03-11, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact on confidentiality, integrity, and availability.

An unauthorized attacker with network access can exploit this vulnerability to execute code remotely. Exploitation requires high attack complexity but no privileges, user interaction, or scope change, enabling remote code execution against affected systems running the vulnerable Remote Desktop Services component.

The Microsoft Security Response Center provides guidance on this vulnerability, including details on patches and mitigation, in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24045.

Details

CWE(s)
CWE-591

Affected Products

microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.7876
microsoft
windows server 2019
≤ 10.0.17763.7009
microsoft
windows server 2022
≤ 10.0.20348.3270
microsoft
windows server 2022 23h2
≤ 10.0.25398.1486
microsoft
windows server 2025
≤ 10.0.26100.3403

MITRE ATT&CK Enterprise Techniques

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

The vulnerability provides unauthenticated remote code execution in Windows Remote Desktop Services over the network, directly enabling the Exploitation of Remote Services technique for initial access or lateral movement.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References