EUVD-2025-17774CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS) that allows authenticated network attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. This is a critical vulnerability affecting RRAS implementations across Windows Server and client operating systems; exploitation requires valid credentials but no user interaction, making it suitable for lateral movement and privilege escalation scenarios within compromised networks.
Technical ContextAI
The vulnerability exists in the Windows Routing and Remote Access Service (RRAS), a core Windows networking component responsible for managing dial-up, VPN, and routing connections. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), indicating improper bounds checking when writing to dynamically allocated heap memory within RRAS protocol handlers. This likely occurs during processing of remote access protocol messages (potentially PPP, SSTP, L2TP, or IKEv2 implementations). The heap overflow allows attackers to corrupt adjacent heap structures, potentially achieving code execution through heap spray techniques or return-oriented programming (ROP) chains. Affected systems include Windows Server (2016, 2019, 2022) and client versions (Windows 10, Windows 11) with RRAS enabled, correlating to CPE patterns like 'cpe:2.3:o:microsoft:windows_server:*' and 'cpe:2.3:o:microsoft:windows:*' where RRAS is active.
RemediationAI
Immediate actions: (1) Apply the latest Microsoft security patch for Windows/Windows Server as released by Microsoft (expected in regular or out-of-band security updates); (2) If patches are unavailable, implement network-level mitigations: restrict access to RRAS ports (typically UDP 500, 1194, 1701, 443 for VPN protocols) using firewall rules; restrict RRAS access to trusted source IP ranges; (3) Disable RRAS on systems where it is not required; (4) Enable strong authentication (MFA/2FA) on VPN and remote access endpoints to reduce credential compromise risk; (5) Monitor RRAS logs for suspicious protocol messages and unexpected connection attempts; (6) Implement network segmentation to isolate RRAS infrastructure. Check Microsoft Security Update Guide (https://msrc.microsoft.com) and Windows Server Security Updates for specific KB articles and patch versions. Vendor advisories will provide definitive remediation guidance with specific build numbers.
More from same product – last 7 days
{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Share
External POC / Exploit Code
Leaving vuln.today