{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2025-009.pdf"
    },
    "title": "Critical Vulnerabilities in Windows Remote Desktop Services",
    "serial_number": "2025-009",
    "publish_date": "14-03-2025 16:01:59",
    "description": "On March 13, Microsoft has released its March security update, addressing 57 vulnerabilities across its product range, including six critical flaws. Among the critical vulnerabilities are CVE-2025-24035 and CVE-2025-24045, both Remote Code Execution (RCE) vulnerabilities in Windows Remote Desktop Services (RDS). Each vulnerability has been assigned a CVSSv3 score of 8.1 and is rated as critical.<br>\nIt is recommended updating affected assets as soon as possible.<br>\n",
    "url_title": "2025-009",
    "content_markdown": "---\ntitle: 'Critical Vulnerabilities in\u00a0Windows\u00a0Remote\u00a0Desktop\u00a0Services'\nnumber: '2025-009'\nversion: '1.0'\noriginal_date: '2025-03-13'\ndate: '2025-03-14'\n---\n\n_History:_\n\n* _14/03/2025 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn March 13, Microsoft has released its March security update, addressing 57 vulnerabilities across its product range, including six critical flaws. Among the critical vulnerabilities are **CVE-2025-24035** and **CVE-2025-24045**, both Remote Code Execution (RCE) vulnerabilities in Windows Remote Desktop Services (RDS). Each vulnerability has been assigned a CVSSv3 score of 8.1 and is rated as critical [1].\n\nIt is recommended updating affected assets as soon as possible.\n\n# Technical Details\n\nThe vulnerability **CVE-2025-24035** is caused by sensitive data storage in improperly locked memory and **CVE-2025-24045** is a more complex vulnerability to exploit, requiring an attacker to win a race condition [1].\n\nSuccessful exploitation of these vulnerabilities could allow an unauthorised attacker to execute code over a network [1].\n\nMicrosoft has addressed 57 vulnerabilities in its products as part of the March 2025 Patch Tuesday update [2].\n\n# Affected Products\n\nThe following products are affected by **CVE-2025-24035** [3]:\n\n- Windows Server 2008 R2\n- Windows Server 2008\n- Windows Server 2012 R2\n- Windows Server 2012\n- Windows Server 2016\n- Windows Server 2019\n- Windows Server 2022\n- Windows Server 2025\n- Windows 10\n- Windows 11\n\nThe following products are affected by **CVE-2025-24045** [4]:\n\n- Windows Server 2012\n- Windows Server 2012 R2\n- Windows Server 2016\n- Windows Server 2019\n- Windows Server 2022\n- Windows Server 2025\n\n# Recommendations\n\nCERT-EU recommends updating the affected products as soon as possible to the latest version, prioritising Internet facing applications.\n\nIt is also recommended restricting network access to sensitive services to only trusted network sources.\n\n# References\n\n[1] <https://cybersecuritynews.com/windows-remote-desktop-services-code-vulnerability/>\n\n[2] <https://msrc.microsoft.com/update-guide/releaseNote/2025-Mar>\n\n[3] <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24035>\n\n[4] <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24045>",
    "content_html": "<p><em>History:</em></p><ul><li><em>14/03/2025 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On March 13, Microsoft has released its March security update, addressing 57 vulnerabilities across its product range, including six critical flaws. Among the critical vulnerabilities are <strong>CVE-2025-24035</strong> and <strong>CVE-2025-24045</strong>, both Remote Code Execution (RCE) vulnerabilities in Windows Remote Desktop Services (RDS). Each vulnerability has been assigned a CVSSv3 score of 8.1 and is rated as critical [1].</p><p>It is recommended updating affected assets as soon as possible.</p><h2 id=\"technical-details\">Technical Details</h2><p>The vulnerability <strong>CVE-2025-24035</strong> is caused by sensitive data storage in improperly locked memory and <strong>CVE-2025-24045</strong> is a more complex vulnerability to exploit, requiring an attacker to win a race condition [1].</p><p>Successful exploitation of these vulnerabilities could allow an unauthorised attacker to execute code over a network [1].</p><p>Microsoft has addressed 57 vulnerabilities in its products as part of the March 2025 Patch Tuesday update [2].</p><h2 id=\"affected-products\">Affected Products</h2><p>The following products are affected by <strong>CVE-2025-24035</strong> [3]:</p><ul><li>Windows Server 2008 R2</li><li>Windows Server 2008</li><li>Windows Server 2012 R2</li><li>Windows Server 2012</li><li>Windows Server 2016</li><li>Windows Server 2019</li><li>Windows Server 2022</li><li>Windows Server 2025</li><li>Windows 10</li><li>Windows 11</li></ul><p>The following products are affected by <strong>CVE-2025-24045</strong> [4]:</p><ul><li>Windows Server 2012</li><li>Windows Server 2012 R2</li><li>Windows Server 2016</li><li>Windows Server 2019</li><li>Windows Server 2022</li><li>Windows Server 2025</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU recommends updating the affected products as soon as possible to the latest version, prioritising Internet facing applications.</p><p>It is also recommended restricting network access to sensitive services to only trusted network sources.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://cybersecuritynews.com/windows-remote-desktop-services-code-vulnerability/\">https://cybersecuritynews.com/windows-remote-desktop-services-code-vulnerability/</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://msrc.microsoft.com/update-guide/releaseNote/2025-Mar\">https://msrc.microsoft.com/update-guide/releaseNote/2025-Mar</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24035\">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24035</a></p><p>[4] <a rel=\"noopener\" target=\"_blank\" href=\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24045\">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24045</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}