Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2024-43454: Windows Remote Desktop Service allows remote code execution
CVE-2024-43454 · published 2 years ago
Summary
A security flaw in the Windows Remote Desktop Service can allow an attacker to execute arbitrary code on a remote Windows system. This could lead to unauthorized access and control of the system. To protect your system, ensure that all Windows updates are installed and consider enabling the Windows Firewall to block incoming connections to the Remote Desktop Service.
What to do
- Update microsoft windows_server_2016 to version 10.0.14393.7336 or later.
- Update microsoft windows_server_2019 to version 10.0.17763.6293 or later.
- Update microsoft windows_server_2022 to version 10.0.20348.2700 or later.
- Update microsoft windows_server_2022_23h2 to version 10.0.25398.1128 or later.
- Update microsoft windows server 2019 to version 10.0.17763.6293 or later.
- Update microsoft windows server 2008 service pack 2 to version 6.0.6003.22870 or later.
- Update microsoft windows server 2008 r2 service pack 1 to version 6.1.7601.27320 or later.
- Update microsoft windows server 2008 r2 service pack 1 (server core installation) to version 6.1.7601.27320 or later.
- Update microsoft windows server 2008 service pack 2 to version 6.0.6003.22870 or later.
- Update microsoft windows server 2008 service pack 2 (server core installation) to version 6.0.6003.22870 or later.
- Update microsoft windows server 2012 to version 6.2.9200.25073 or later.
- Update microsoft windows server 2012 (server core installation) to version 6.2.9200.25073 or later.
- Update microsoft windows server 2012 r2 to version 6.3.9600.22175 or later.
- Update microsoft windows server 2012 r2 (server core installation) to version 6.3.9600.22175 or later.
- Update microsoft windows server 2016 to version 10.0.14393.7336 or later.
- Update microsoft windows server 2016 (server core installation) to version 10.0.14393.7336 or later.
- Update microsoft windows server 2019 (server core installation) to version 10.0.17763.6293 or later.
- Update microsoft windows server 2022 to version 10.0.20348.2700 or later.
- Update microsoft windows server 2022, 23h2 edition (server core installation) to version 10.0.25398.1128 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | windows_server_2008 |
r2 sp2 cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* |
| microsoft | windows_server_2012 |
r2 cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* |
| microsoft | windows_server_2016 |
< 10.0.14393.7336 cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* |
| microsoft | windows_server_2019 |
< 10.0.17763.6293 cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* |
| microsoft | windows_server_2022 |
< 10.0.20348.2700 cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* |
| microsoft | windows_server_2022_23h2 |
< 10.0.25398.1128 cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* |
| microsoft | windows server 2019 | < 10.0.17763.6293 |
| microsoft | windows server 2008 service pack 2 | < 6.0.6003.22870 |
| microsoft | windows server 2008 r2 service pack 1 | < 6.1.7601.27320 |
| microsoft | windows server 2008 r2 service pack 1 (server core installation) | < 6.1.7601.27320 |
| microsoft | windows server 2008 service pack 2 | < 6.0.6003.22870 |
| microsoft | windows server 2008 service pack 2 (server core installation) | < 6.0.6003.22870 |
| microsoft | windows server 2012 | < 6.2.9200.25073 |
| microsoft | windows server 2012 (server core installation) | < 6.2.9200.25073 |
| microsoft | windows server 2012 r2 | < 6.3.9600.22175 |
| microsoft | windows server 2012 r2 (server core installation) | < 6.3.9600.22175 |
| microsoft | windows server 2016 | < 10.0.14393.7336 |
| microsoft | windows server 2016 (server core installation) | < 10.0.14393.7336 |
| microsoft | windows server 2019 (server core installation) | < 10.0.17763.6293 |
| microsoft | windows server 2022 | < 10.0.20348.2700 |
| microsoft | windows server 2022, 23h2 edition (server core installation) | < 10.0.25398.1128 |
Original advisory text
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43454 Patch Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-23Relative Path Traversal
Timeline
Published10 Sep 2024
Updated16 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta