CVE-2019-0708
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Description
CVE-2019-0708, widely known as BlueKeep, is a CRITICAL remote code execution vulnerability affecting Microsoft Remote Desktop Services (formerly Terminal Services), carrying a CVSS 3.1 score of 9.8. An unauthenticated attacker can connect to the target system using RDP and send specially crafted requests to achieve remote code execution without any user interaction. Affected products include Windows 7, Windows Server 2008 and 2008 R2, Windows XP, and Windows Server 2003. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. With an EPSS score of 0.94454 (99.99th percentile), this vulnerability demonstrates the highest level of real-world exploitation probability. This vulnerability has known ransomware associations and is considered wormable, meaning it can propagate without user interaction similar to the EternalBlue-powered WannaCry attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows server 2008 | -; r2 |
| siemens | axiom multix m firmware | All versions |
| siemens | axiom vertix md trauma firmware | All versions |
| siemens | axiom vertix solitaire m firmware | All versions |
| siemens | mobilett xp digital firmware | All versions |
| siemens | multix pro acss p firmware | All versions |
| siemens | multix pro p firmware | All versions |
| siemens | multix pro firmware | All versions |
| siemens | multix pro acss firmware | All versions |
| siemens | multix pro navy firmware | All versions |
| siemens | multix swing firmware | All versions |
| siemens | multix top firmware | All versions |
| siemens | multix top acss firmware | All versions |
| siemens | multix top p firmware | All versions |
| siemens | multix top acss p firmware | All versions |
| siemens | vertix solitaire firmware | All versions |
| siemens | atellica solution firmware | All versions |
| siemens | aptio firmware | All versions |
| siemens | streamlab firmware | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en(Third Party Advisory)
- http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf(Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0708(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2019-0708 is classified under CWE-416 — Use After Free. Use After Free (UAF) vulnerabilities occur when software continues to use a pointer after the memory it references has been freed. Once memory is freed, it may be reallocated for other purposes. If the dangling pointer is subsequently dereferenced, the program may read or write to memory now used for different data structures, leading to data corruption, information disclosure, or code execution.
In the context of Microsoft Remote Desktop Services, the use-after-free condition exists in the RDP protocol handling code. When an attacker sends specially crafted RDP connection requests, the service incorrectly frees an internal channel object but retains a reference to it. Subsequent operations that use this dangling reference can be manipulated to achieve arbitrary code execution at the SYSTEM privilege level. The pre-authentication nature of this flaw, combined with the use-after-free primitive, makes it exceptionally dangerous and wormable.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2019-0708 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker SYSTEM-level access to the targeted system without any authentication, exposing all data including credentials, documents, encryption keys, and any sensitive information stored on or accessible from the compromised machine.
Integrity (HIGH): With SYSTEM-level code execution, attackers can install backdoors, deploy malware, modify system configurations, create new administrator accounts, and alter or destroy critical data.
Availability (NONE per CVSS, but HIGH in practice): While the CVSS vector rates Availability impact as NONE, real-world exploitation has demonstrated significant availability impacts through system crashes, ransomware deployment, and denial of service. The wormable nature amplifies availability risks across entire networks.
Scope Unchanged: The CVSS scope is Unchanged, but the wormable characteristic means a single compromised host can automatically propagate the attack to all reachable RDP-enabled systems, creating a cascading failure scenario.
With an EPSS score of 0.94454 (99.99th percentile) and confirmed ransomware associations, BlueKeep represents one of the most critical vulnerabilities in the modern threat landscape.
Exploit Maturity
CVE-2019-0708 (BlueKeep) has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Multiple weaponized exploits are publicly available, including Metasploit modules and standalone proof-of-concept code. The vulnerability was first patched in May 2019, and reliable remote code execution exploits emerged within months. Microsoft took the extraordinary step of releasing patches for out-of-support operating systems (Windows XP and Server 2003) due to the severity.
Ransomware association: This vulnerability has confirmed ransomware associations. Threat actors have leveraged BlueKeep for initial access in ransomware campaigns, and its wormable nature creates the potential for self-propagating ransomware similar to WannaCry.
Attack surface: RDP (port 3389) is one of the most commonly exposed services on the internet. Shodan and Censys scans consistently identify millions of RDP endpoints exposed to the internet. The vulnerability requires no authentication and no user interaction, making it a prime target for automated exploitation and scanning.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Microsoft, NSA, and multiple cybersecurity agencies issued urgent warnings about this vulnerability, reflecting its exceptional severity.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Install the May 2019 Microsoft security update from the Microsoft Security Advisory for all affected systems including Windows 7, Server 2008, and legacy systems.
- Enable Network Level Authentication (NLA). NLA requires authentication before a full RDP connection is established, providing a partial mitigation against unauthenticated exploitation. Enable NLA on all RDP-enabled systems as a defense-in-depth measure.
- Restrict RDP access. Block RDP (port 3389) at network perimeter firewalls. Use VPN connections or jump servers for remote access instead of exposing RDP directly to the internet. Implement network segmentation to limit lateral movement via RDP.
- Verify affected product versions in your environment. Identify all systems running Windows 7, Windows Server 2008/R2, Windows XP, or Windows Server 2003 with Remote Desktop Services enabled. Use vulnerability scanning to ensure complete coverage.
- Scan for signs of prior exploitation. Review RDP connection logs, Windows event logs, and network traffic logs for indicators of BlueKeep exploitation attempts. Check for unusual RDP connection patterns and signs of lateral movement.
- Implement RDP-specific monitoring. Deploy intrusion detection signatures for BlueKeep exploitation attempts. Monitor for anomalous RDP traffic patterns, connection attempts from unusual sources, and signs of automated scanning on port 3389.
Technical Details
CVE-2019-0708 is a CRITICAL-severity vulnerability in Microsoft Remote Desktop Services that can be exploited remotely over the network with no authentication and no user interaction required. The attack complexity is low.
Technical mechanism: The vulnerability exists in the Remote Desktop Protocol (RDP) handling code within the Remote Desktop Services component. When processing specially crafted RDP connection requests, the service incorrectly binds a virtual channel named MS_T120 to a channel other than the expected channel 31. When the connection is subsequently terminated, a use-after-free condition is triggered because the MS_T120 channel object is freed while a dangling reference remains. An attacker can manipulate this freed memory through heap grooming techniques to achieve arbitrary code execution at the SYSTEM privilege level. The exploit operates at the pre-authentication stage of the RDP connection, before any credentials are required.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reflects an Attack Vector of NETWORK, Attack Complexity of LOW, Privileges Required of NONE, User Interaction of NONE, Scope UNCHANGED, and HIGH impact on Confidentiality and Integrity. The combination of network accessibility, no authentication requirement, and no user interaction makes this one of the most easily exploitable critical vulnerabilities.
Frequently Asked Questions
Is CVE-2019-0708 being actively exploited?
Yes, CVE-2019-0708 (BlueKeep) has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. Multiple public exploits including Metasploit modules are available. Microsoft, NSA, and CISA issued urgent warnings about this vulnerability. The EPSS score of 0.94454 (99.99th percentile) represents the highest exploitation probability tier.
Which products are affected by CVE-2019-0708?
Affected products include Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows XP, and Windows Server 2003. Microsoft released patches for all these versions, including the out-of-support Windows XP and Server 2003, reflecting the exceptional severity. Any system with Remote Desktop Services enabled and missing the May 2019 patch is vulnerable.
How do I fix CVE-2019-0708?
Apply the May 2019 Microsoft security update for all affected systems. Enable Network Level Authentication (NLA) as a defense-in-depth measure. Block RDP access at network perimeter firewalls and use VPN or jump servers instead. Implement network segmentation to limit potential lateral movement.
How severe is CVE-2019-0708?
CVE-2019-0708 is rated CRITICAL with a CVSS 3.1 score of 9.8, the near-maximum severity rating. With an EPSS score of 0.94454 (99.99th percentile), it has the highest exploitation probability. It requires no authentication, no user interaction, and is wormable. It has confirmed ransomware associations and prompted urgent warnings from Microsoft, NSA, and CISA.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.