Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2024-43592: Windows RRAS Remote Code Execution Vulnerability
CVE-2024-43592 · published 2 years ago
Summary
A vulnerability in Windows RRAS allows attackers to execute malicious code on affected systems, potentially giving them control over the system. This could lead to data theft, disruption of services, or the installation of malware. Upgrade or patch your Windows systems to the latest version to mitigate this risk.
What to do
- Update microsoft windows_server_2016 to version 10.0.14393.7428 or later.
- Update microsoft windows_server_2019 to version 10.0.17763.6414 or later.
- Update microsoft windows_server_2022 to version 10.0.20348.2762 or later.
- Update microsoft windows_server_2022_23h2 to version 10.0.25398.1189 or later.
- Update microsoft windows server 2008 service pack 2 to version 6.0.6003.22918 or later.
- Update microsoft windows server 2008 r2 service pack 1 to version 6.1.7601.27366 or later.
- Update microsoft windows server 2008 r2 service pack 1 (server core installation) to version 6.1.7601.27366 or later.
- Update microsoft windows server 2008 service pack 2 to version 6.0.6003.22918 or later.
- Update microsoft windows server 2008 service pack 2 (server core installation) to version 6.0.6003.22918 or later.
- Update microsoft windows server 2012 to version 6.2.9200.25118 or later.
- Update microsoft windows server 2012 (server core installation) to version 6.2.9200.25118 or later.
- Update microsoft windows server 2012 r2 to version 6.3.9600.22221 or later.
- Update microsoft windows server 2012 r2 (server core installation) to version 6.3.9600.22221 or later.
- Update microsoft windows server 2016 to version 10.0.14393.7428 or later.
- Update microsoft windows server 2016 (server core installation) to version 10.0.14393.7428 or later.
- Update microsoft windows server 2019 to version 10.0.17763.6414 or later.
- Update microsoft windows server 2019 (server core installation) to version 10.0.17763.6414 or later.
- Update microsoft windows server 2022 to version 10.0.20348.2762 or later.
- Update microsoft windows server 2022, 23h2 edition (server core installation) to version 10.0.25398.1189 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | windows_server_2008 |
r2 cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* |
| microsoft | windows_server_2012 |
r2 cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* |
| microsoft | windows_server_2016 |
< 10.0.14393.7428 cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* |
| microsoft | windows_server_2019 |
< 10.0.17763.6414 cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* |
| microsoft | windows_server_2022 |
< 10.0.20348.2762 cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* |
| microsoft | windows_server_2022_23h2 |
< 10.0.25398.1189 cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* |
| microsoft | windows server 2008 service pack 2 | < 6.0.6003.22918 |
| microsoft | windows server 2008 r2 service pack 1 | < 6.1.7601.27366 |
| microsoft | windows server 2008 r2 service pack 1 (server core installation) | < 6.1.7601.27366 |
| microsoft | windows server 2008 service pack 2 | < 6.0.6003.22918 |
| microsoft | windows server 2008 service pack 2 (server core installation) | < 6.0.6003.22918 |
| microsoft | windows server 2012 | < 6.2.9200.25118 |
| microsoft | windows server 2012 (server core installation) | < 6.2.9200.25118 |
| microsoft | windows server 2012 r2 | < 6.3.9600.22221 |
| microsoft | windows server 2012 r2 (server core installation) | < 6.3.9600.22221 |
| microsoft | windows server 2016 | < 10.0.14393.7428 |
| microsoft | windows server 2016 (server core installation) | < 10.0.14393.7428 |
| microsoft | windows server 2019 | < 10.0.17763.6414 |
| microsoft | windows server 2019 (server core installation) | < 10.0.17763.6414 |
| microsoft | windows server 2022 | < 10.0.20348.2762 |
| microsoft | windows server 2022, 23h2 edition (server core installation) | < 10.0.25398.1189 |
Original advisory text
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43592 Patch Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-20Improper Input Validation
CWE-122Heap-based Buffer Overflow
Timeline
Published8 Oct 2024
Updated3 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta