CVE-2019-1222

published 2019-08-14

CVE-2019-1222: A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to…

Priority P2 67 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.
The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.

Affected

23 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10_version_1803	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1809	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1903_for_32-bit_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1903_for_arm64-based_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1903_for_x64-based_systems	>= 10.0.0 < publication	publication
microsoft	windows_server_2016	—	—
microsoft	windows_server_2016	—	—
microsoft	windows_server_2019	>= 10.0.0 < publication	publication
msrc	windows_10_version_1803_for_32-bit_systems	—	—
msrc	windows_10_version_1803_for_arm64-based_systems	—	—
msrc	windows_10_version_1803_for_x64-based_systems	—	—
msrc	windows_10_version_1809_for_32-bit_systems	—	—
msrc	windows_10_version_1809_for_arm64-based_systems	—	—
msrc	windows_10_version_1809_for_x64-based_systems	—	—
msrc	windows_10_version_1903_for_32-bit_systems	—	—
msrc	windows_10_version_1903_for_arm64-based_systems	—	—
msrc	windows_10_version_1903_for_x64-based_systems	—	—
msrc	windows_server_2019	—	—
msrc	windows_server_version_1803	—	—
msrc	windows_server_version_1903	—	—

Detection & IOCs extracted from sources · hover to see the quote

port TCP/3389↗

• → Monitor for unauthenticated RDP connection attempts (pre-authentication exploitation) — no user interaction required; alert on RDP sessions that do not complete NLA handshake before sending crafted requests. ↗
• → Flag inbound TCP/3389 traffic from external/untrusted sources, especially connection requests that deviate from normal RDP handshake patterns, as exploitation occurs via specially crafted RDP connection requests. ↗
• → Detect RDP sessions where Network Level Authentication (NLA) is NOT enforced — exploitation requires no prior authentication, so absence of NLA is a prerequisite condition for this attack vector. ↗

• · Exploitation is rated 'More Likely' for both latest and older software releases per Microsoft's exploit index, despite no public exploit or in-the-wild exploitation confirmed at time of advisory. ↗
• · Blocking TCP/3389 at the perimeter only protects against external attackers; internal network attackers can still exploit the vulnerability if systems are unpatched. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

vendor_msrc 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.