Windows RRAS CVE-2025-62549

Requires the Routing and Remote Access Service (RRAS) role to be installed and enabled on the target Windows host - RRAS is an optional role that is NOT enabled by default, which substantially narrows the exposed population. Exploitation further requires user interaction (UI:R): consistent with RRAS's design, a user/client must be induced to connect to an attacker-controlled routing/VPN endpoint over the network. No authentication is required of the attacker (PR:N). Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2/24H2/25H2), and Windows Server 2008 through 2025. Limiting factors: non-default feature, mandatory user interaction, and network path to the malicious endpoint.

Signals are moderately elevated but not critical. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) indicates unauthenticated network-reachable code execution with full CIA impact, but the UI:R requirement means a user must be induced to act (in RRAS's typical pattern, connecting a client to an attacker-controlled routing/VPN endpoint), which materially lowers real-world exploitability versus a wormable AV:N/UI:N flaw. EPSS is 1.32% (70th percentile) - above the median for a Patch-Tuesday item, signaling somewhat greater research interest, but still far from high-probability exploitation. There is NO CISA KEV listing and NO public exploit code - the two Vicarius references are a detection script and a mitigation script, NOT weaponized PoC, so they must not be read as exploitation evidence. No SSVC decision data was provided. A key mitigating fact absent from the CVSS math: RRAS is an OPTIONAL Windows role that is not enabled by default, so the true exposed population is a small subset of the ubiquitous Windows install base. Net: a genuine but second-tier priority - patch on the normal cycle, prioritizing hosts where RRAS is actually enabled.

An attacker stands up a malicious RRAS/VPN or routing endpoint and lures a victim on a vulnerable Windows host into initiating a connection to it (UI:R). Crafted protocol data triggers the untrusted pointer dereference (CWE-822) in the RRAS service, redirecting execution and running attacker-controlled code over the network. No public exploit code has been identified at time of analysis, and the attack is not confirmed as actively exploited.