CVE-2019-0708
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - secure@microsoft.com
- Published
- 2019-05-16
- Last modified
- 2025-10-21
- Known exploited (CISA KEV)
- since 2021-11-03, action due 2022-05-03: Apply updates per vendor instructions.
- Weaknesses
- CWE-416
Affected products
- Agile Controller-campus Firmware (Huawei)
- Bh620 V2 Firmware (Huawei)
- Bh621 V2 Firmware (Huawei)
- Bh622 V2 Firmware (Huawei)
- Bh640 V2 Firmware (Huawei)
- Ch121 Firmware (Huawei)
- Ch140 Firmware (Huawei)
- Ch220 Firmware (Huawei)
- Ch221 Firmware (Huawei)
- Ch222 Firmware (Huawei)
- Ch240 Firmware (Huawei)
- Ch242 Firmware (Huawei)
- Ch242 V3 Firmware (Huawei)
- E6000 Chassis Firmware (Huawei)
- E6000 Firmware (Huawei)
- Elog Firmware (Huawei)
- Espace Ecs Firmware (Huawei)
- Gtsoftx3000 Firmware (Huawei)
- Oceanstor 18500 Firmware (Huawei)
- Oceanstor 18800 Firmware (Huawei)
- Oceanstor 18800f Firmware (Huawei)
- Oceanstor Hvs85t Firmware (Huawei)
- Oceanstor Hvs88t Firmware (Huawei)
- Rh1288 V2 Firmware (Huawei)
- Rh1288a V2 Firmware (Huawei)
- Rh2265 V2 Firmware (Huawei)
- Rh2268 V2 Firmware (Huawei)
- Rh2285 V2 Firmware (Huawei)
- Rh2285h V2 Firmware (Huawei)
- Rh2288 V2 Firmware (Huawei)
- Rh2288a V2 Firmware (Huawei)
- Rh2288e V2 Firmware (Huawei)
- Rh2288h V2 Firmware (Huawei)
- Rh2485 V2 Firmware (Huawei)
- Rh5885 V2 Firmware (Huawei)
- Rh5885 V3 Firmware (Huawei)
- Seco Vsm Firmware (Huawei)
- Smc2.0 Firmware (Huawei)
- Uma Firmware (Huawei)
- X6000 Firmware (Huawei)
- X8000 Firmware (Huawei)
- Windows (Microsoft)
- Windows 7 (Microsoft)
- Windows Server (Microsoft)
- Windows Server 2008 (Microsoft)
- Aptio Firmware (Siemens)
- Atellica Solution Firmware (Siemens)
- Axiom Multix M Firmware (Siemens)
- Axiom Vertix Md Trauma Firmware (Siemens)
- Axiom Vertix Solitaire M Firmware (Siemens)
- Centralink Firmware (Siemens)
- Lantis Firmware (Siemens)
- Mobilett Xp Digital Firmware (Siemens)
- Multix Pro Acss Firmware (Siemens)
- Multix Pro Acss P Firmware (Siemens)
- Multix Pro Firmware (Siemens)
- Multix Pro Navy Firmware (Siemens)
- Multix Pro P Firmware (Siemens)
- Multix Swing Firmware (Siemens)
- Multix Top Acss Firmware (Siemens)
- Multix Top Acss P Firmware (Siemens)
- Multix Top Firmware (Siemens)
- Multix Top P Firmware (Siemens)
- Rapidpoint 500 Firmware (Siemens)
- Streamlab Firmware (Siemens)
- Syngo Lab Process Manager (Siemens)
- Vertix Solitaire Firmware (Siemens)
- Viva E Firmware (Siemens)
- Viva Twin Firmware (Siemens)
References
- http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html
- http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html
- http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html
- http://packetstormsecurity.com/files/155389/Microsoft-Windows-7-x86-BlueKeep-RDP-Use-After-Free.html
- http://packetstormsecurity.com/files/162960/Microsoft-RDP-Remote-Code-Execution.html
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-windows-en
- http://www.huawei.com/en/psirt/security-notices/huawei-sn-20190515-01-windows-en
- https://cert-portal.siemens.com/productcert/pdf/ssa-166360.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-406175.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-433987.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-832947.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0708
