PT-2019-1129 · Microsoft · Windows Hyper-V+4

Published 2019-01-08 · Updated 2026-01-30 · CVE-2019-0551

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V versions (affected versions not specified) Windows Server 2016 Windows Server 2019 Windows 10 Windows 10 Servers

Description: A remote code execution issue exists due to improper input validation from an authenticated user on a guest operating system. This allows remote attackers to execute arbitrary code and affect the system. The vulnerability is related to deficiencies in the authentication procedure in the guest operating system.

Recommendations: For Windows Server 2016, update the system to prevent exploitation. For Windows Server 2019, apply the necessary security patches to resolve the issue. For Windows 10, ensure that all security updates are installed to mitigate the risk. For Windows 10 Servers, consider restricting access to the Hyper-V system until a patch is available. As a temporary workaround, consider disabling the vulnerable authentication procedure in the guest operating system until a patch is available.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-119

Related Identifiers

BDU:2019-00155

CVE-2019-0551

Affected Products

Windows

Windows 10

Windows Hyper-V

Windows Server 2016

Windows Server 2019

References · 7

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2019-0551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0551 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0551 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0551 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00155 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0551 · Security Note
• http://securityfocus.com/bid/106386 · Note