← Back to browse · API

CVE-2019-1182

Severity
CRITICAL
CVSS
9.8
EPSS
0.13947
Risk score
44.08
CISA KEV
No
PoC
No
Published
2019-08-14
Modified
2024-08-04
First seen
2026-08-07
Aliases
EUVD-2019-9753, GHSA-VW3C-3FMQ-QPGQ
Products
Microsoft:Microsoft Remote Desktop for Android 0 <publication, Microsoft:Microsoft Remote Desktop for IoS 1.0.0 <publication, Microsoft:Microsoft Remote Desktop for Mac 1.0.0 <publication, Microsoft:Windows 10 Version 1507 10.0.0 <publication, Microsoft:Windows 10 Version 1607 10.0.0 <publication, Microsoft:Windows 10 Version 1703 10.0.0 <publication, Microsoft:Windows 10 Version 1709 10.0.0 <publication, Microsoft:Windows 10 Version 1709 for 32-bit Systems 10.0.0 <publication, Microsoft:Windows 10 Version 1803 10.0.0 <publication, Microsoft:Windows 10 Version 1809 10.0.0 <publication, Microsoft:Windows 10 Version 1903 for 32-bit Systems 10.0.0 <publication, Microsoft:Windows 10 Version 1903 for ARM64-based Systems 10.0.0 <publication, Microsoft:Windows 10 Version 1903 for x64-based Systems 10.0.0 <publication, Microsoft:Windows 8.1 6.3.0 <publication, Microsoft:Windows Server 2012 (Server Core installation) 6.2.0 <publication, Microsoft:Windows Server 2012 6.2.0 <publication, Microsoft:Windows Server 2012 R2 (Server Core installation) 6.3.0 <publication, Microsoft:Windows Server 2012 R2 6.3.0 <publication, Microsoft:Windows Server 2016 (Server Core installation) 10.0.0 <publication, Microsoft:Windows Server 2016 10.0.0 <publication, Microsoft:Windows Server 2019 (Server Core installation) 10.0.0 <publication, Microsoft:Windows Server 2019 10.0.0 <publication, Microsoft:Windows Server, version 1803 (Server Core Installation) 10.0.0 <publication, Microsoft:Windows Server, version 1903 (Server Core installation) 10.0.0 <publication
Sources
euvd EUVD-2019-9753

Description

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP. The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.

References