PT-2024-4772 · Microsoft · Windows Server+1

Chunyang Han + 2 · Published 2024-07-09 · Updated 2025-12-04 · CVE-2024-38077

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

The vulnerable software is Microsoft Windows, specifically the Windows Remote Desktop Licensing Service. This pre-authentication remote code execution issue affects all versions of Windows Server from 2000 to 2025. To exploit this issue, an unauthorized attacker can connect to the Remote Desktop Licensing Service and send a malicious message with a special attachment, which can cause remote code execution. An exploit for this issue has been released, allowing attackers to execute arbitrary code on the system and gain full control over the targeted server. Approximately 79,000 instances are exposed online, and around 170,000 hosts are potentially vulnerable.

The exploit works by sending a malicious message to the Remote Desktop Licensing Service, which can cause remote code execution without requiring any user interaction. Several proof-of-concept (PoC) exploits have been published on GitHub.

#WindowsServer #RCE #MadLicense #Cybersecurity #RDP #RDL #Infosec #Exploit #WindowsRemoteDesktop

Exploit

Fix

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2024-05295

CVE-2024-38077

Affected Products

Windows

Windows Server

References · 72

• 🔥 https://github.com/qi4L/CVE-2024-38077 · Exploit
• 🔥 https://github.com/SecStarBot/CVE-2024-38077-POC · Exploit
• 🔥 https://github.com/murphysecurity/RDL-detect · Exploit
• 🔥 https://github.com/mrmtwoj/CVE-2024-38077 · Exploit
• 🔥 https://github.com/zhuxi1965/CVE-2024-38077-RDLCheck · Exploit
• 🔥 https://github.com/BBD-YZZ/fyne-gui · Exploit
• 🔥 https://github.com/Wlibang/CVE-2024-38077 · Exploit
• 🔥 https://github.com/stupid-h4er/CVE-2024-38077-POC · Exploit
• 🔥❌ https://github.com/CloudCrowSec001/CVE-2024-38077-POC · Exploit, Deleted
• 🔥❌ https://github.com/CloudCrowSec001/CVE-2024-38077-POC/tree/main · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-38077 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38077 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38077 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05295 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38077 · Vendor Advisory