Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Windows RRAS allows unauthorized access to sensitive network data

CVE-2025-54096 · published 1 year ago
Summary

A security issue in Windows RRAS allows an attacker to access confidential network information. This can happen when an attacker sends specially crafted network traffic. To protect your network, apply the latest Windows updates and configure your RRAS settings securely.

What to do
  • Update microsoft windows_server_2016 to version 10.0.14393.8422 or later.
  • Update microsoft windows_server_2019 to version 10.0.17763.7792 or later.
  • Update microsoft windows_server_2022 to version 10.0.20348.4106 or later.
  • Update microsoft windows_server_2022_23h2 to version 10.0.25398.1849 or later.
  • Update microsoft windows_server_2025 to version 10.0.26100.6508 or later.
Affected software
VendorProductAffected versions
microsoft windows_server_2008 r2
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
microsoft windows_server_2012 r2
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoft windows_server_2016 < 10.0.14393.8422
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft windows_server_2019 < 10.0.17763.7792
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft windows_server_2022 < 10.0.20348.4106
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft windows_server_2022_23h2 < 10.0.25398.1849
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
microsoft windows_server_2025 < 10.0.26100.6508
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Original advisory text
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published9 Sep 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-54096 · NVD
Track software like this
Free during beta