PT-2019-2920 · Microsoft · Windows Server 2012 R2+7

Published 2019-08-13 · Updated 2025-09-26 · CVE-2019-1181

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Remote Desktop Services versions prior to the fixed version, including Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, and all supported versions of Windows 10, including server versions.

Description A remote code execution issue exists in Remote Desktop Services when an unauthenticated attacker connects using RDP and sends specially crafted requests. This issue is pre-authentication and requires no user interaction, allowing an attacker to execute arbitrary code on the target system, install programs, view, change, or delete data, or create new accounts with full user rights. The issue arises from errors in checking RDP connection requests.

Recommendations For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, and all supported versions of Windows 10, including server versions, update to the latest version that includes the fix for this issue. As a temporary workaround, consider enabling Network Level Authentication (NLA) on affected systems to partially mitigate the issue. Restrict access to the Remote Desktop Service via RDP to minimize the risk of exploitation until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-02892

BDU:2019-02893

CVE-2019-1181

Affected Products

Remote Desktop Services

Windows

Windows 10

Windows 7

Windows 8.1

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

References · 15

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1181 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/629257 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1181 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02893 · Security Note
• https://bdu.fstec.ru/vul/2019-02892 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1181 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1181 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-187667.pdf · Note
• https://t.me/avleonovcom/622 · Telegram Post
• https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2019-005.pdf · Note
• https://t.me/sysadm_in_channel/1029 · Telegram Post
• https://t.me/cybershit/558 · Telegram Post
• https://twitter.com/alexjplaskett/status/1754097202434052605 · Twitter Post
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20190819-01-windows-en · Note
• https://twitter.com/OffFuck7394/status/1809005783205474400 · Twitter Post