cbcvebase.
CVE-2024-30080
published 2024-06-11

CVE-2024-30080: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

PriorityP275critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
43.15%
98.6th percentile
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Affected

43 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.2068010.0.10240.20680
microsoftwindows_10_1607< 10.0.14393.707010.0.14393.7070
microsoftwindows_10_1809< 10.0.17763.593610.0.17763.5936
microsoftwindows_10_21h1< 10.0.19043.452910.0.19043.4529
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2068010.0.10240.20680
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.707010.0.14393.7070
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.593610.0.17763.5936
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.593610.0.17763.5936
microsoftwindows_10_version_21h2>= 10.0.19044.0 < 10.0.19044.452910.0.19044.4529
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.452910.0.19045.4529
microsoftwindows_11_21h2< 10.0.22000.301910.0.22000.3019
microsoftwindows_11_22h2< 10.0.22621.373710.0.22621.3737
microsoftwindows_11_23h2< 10.0.22631.373710.0.22631.3737
microsoftwindows_11_version_21h2>= 10.0.22000.0 < 10.0.22000.301910.0.22000.3019
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.373710.0.22621.3737
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.373710.0.22631.3737
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.271706.1.7601.27170
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.227206.0.6003.22720
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.249196.2.9200.24919
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.220236.3.9600.22023
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.707010.0.14393.7070
microsoftwindows_server_2019< 10.0.17763.593610.0.17763.5936
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.593610.0.17763.5936

Detection & IOCsextracted from sources · hover to see the quote

portTCP/1801
  • Check if the Windows 'Message Queuing' service is enabled AND TCP port 1801 is listening — both conditions are required for exploitability
  • Check if the MSMQ HTTP-Support feature is enabled on the host as an additional exploitability indicator
  • Detect exploitation attempts by monitoring for a rapid sequence of specially crafted MSMQ packets sent over HTTP to the MSMQ server
  • Use Shodan or equivalent internet-exposure scanning to identify internet-facing MSMQ servers (port 1801) that may be targeted
  • Check Point IPS blade signature available for this CVE — use for network-level detection
  • ·MSMQ is NOT enabled by default on Windows; exploitation requires the service to be explicitly enabled, making exposure limited to systems where it has been deliberately configured
  • ·No authentication is required to exploit this vulnerability — any unauthenticated attacker with network access to TCP/1801 can attempt exploitation
  • ·As of the MSRC advisory, the vulnerability had not been publicly exploited but was rated 'Exploitation More Likely'

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.