PT-2019-2094 · Microsoft+1 · Remote Desktop Services+2

Published 2019-05-14 · Updated 2026-03-10 · CVE-2019-0708

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Remote Desktop Services versions prior to patchday of May 2019 Windows 2003 Windows XP Windows Vista Windows 7 Windows Server 2008 Windows Server 2008 R2

Description A remote code execution vulnerability exists in Remote Desktop Services (formerly known as Terminal Services) when an unauthenticated attacker connects to a target system using RDP and sends specially crafted requests. This vulnerability occurs during pre-authentication and does not require user interaction. Successful exploitation allows an attacker to execute arbitrary code on the target system, potentially enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability, also known as 'BlueKeep' (CVE-2019-0708), has been observed in attacks by the Kimsuky APT group. Reports indicate that malicious actors are distributing malware disguised as exploits for this vulnerability, such as Houdini RAT. There have been instances of attackers attempting to exploit this vulnerability, and scans indicate a significant percentage of publicly accessible RDP services remain vulnerable.

Recommendations Windows 2003: Apply the latest security updates available from Microsoft. Windows XP: Apply the latest security updates available from Microsoft. Windows Vista: Apply the latest security updates available from Microsoft. Windows 7: Apply the latest security updates available from Microsoft. Windows Server 2008: Apply the latest security updates available from Microsoft. Windows Server 2008 R2: Apply the latest security updates available from Microsoft.

Exploit

Fix

RCE

Use After Free

Weakness Enumeration

CWE-20

CWE-416

Related Identifiers

BDU:2019-01846

CVE-2019-0708

MICROSOFTRDPCVE_2019_0708

Affected Products

Huawei Vrp

Remote Desktop Services

Windows

References · 218

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/rdp/cve_2019_0708_bluekeep_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/rdp/cve_2019_0708_bluekeep.rb · Exploit
• 🔥 https://github.com/Ekultek/BlueKeep · Exploit
• 🔥 https://github.com/robertdavidgraham/rdpscan · Exploit
• 🔥 https://github.com/n1xbyte/CVE-2019-0708 · Exploit
• 🔥 https://github.com/k8gege/CVE-2019-0708 · Exploit
• 🔥 https://github.com/algo7/bluekeep_CVE-2019-0708_poc_to_exploit · Exploit
• 🔥 https://github.com/cbwang505/CVE-2019-0708-EXP-Windows · Exploit
• 🔥 https://github.com/0xeb-bp/bluekeep · Exploit
• 🔥 https://github.com/victor0013/CVE-2019-0708 · Exploit
• 🔥 https://github.com/Cyb0r9/ispy · Exploit
• 🔥 https://github.com/dorkerdevil/Remote-Desktop-Services-Remote-Code-Execution-Vulnerability-CVE-2019-0708- · Exploit
• 🔥 https://github.com/RICSecLab/CVE-2019-0708 · Exploit
• 🔥 https://github.com/Leoid/CVE-2019-0708 · Exploit
• 🔥 https://github.com/CVE-2019-0708/CVE-2019-0708 · Exploit