CVE-2019-0708

Remote Desktop lets someone control a computer from another location. This flaw can let an outsider take over a vulnerable computer like finding an unlocked service entrance to your office, then use that access to disrupt work or deploy ransomware.

This matters if you run Windows or Windows Server with Remote Desktop enabled. It also warrants vendor confirmation for listed industrial systems that use these platforms. It is only a risk when Remote Desktop is reachable by an attacker.

Attackers have already exploited this flaw in ransomware campaigns, and it is listed in CISA's catalog of vulnerabilities known to be exploited. Treat internet-accessible Remote Desktop systems as an immediate priority; CISA's remediation due date was May 3, 2022.

Confirm exposure by inventorying Windows and Windows Server hosts, checking whether Remote Desktop Services is enabled, and identifying any RDP listeners or firewall/NAT rules that permit external access. Apply the Microsoft updates specified for CVE-2019-0708 through the Microsoft advisory; the supplied findings do not identify fixed version numbers or release branches. For affected appliances or industrial equipment, obtain the vendor-approved update path before changing the embedded operating system; Spacelabs XTR remediation is version v1.2.1 or later where applicable. If patching is delayed, disable Remote Desktop where possible, remove internet exposure through firewall and remote-access rules, and restrict necessary access to trusted administrative paths. CISA's KEV remediation due date was 2022-05-03. Review remote-access logs and investigate unexpected Remote Desktop connections, new administrator accounts, or ransomware-related activity after remediation.

CVSS v3.1 is 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CVE-2019-0708 is a CWE-416 use-after-free vulnerability in Remote Desktop Services, reachable over RDP by an unauthenticated network attacker using specially crafted requests. CISA KEV listing confirms real-world exploitation, including ransomware campaigns; five public exploits are known. The supplied EPSS prediction is rising, but confirmed exploitation is the controlling signal.