cbcvebase.
CVE-2024-43582
published 2024-10-08

CVE-2024-43582: Remote Desktop Protocol Server Remote Code Execution Vulnerability

PriorityP354high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
3.13%
86.4th percentile
Remote Desktop Protocol Server Remote Code Execution Vulnerability

Affected

30 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1809< 10.0.17763.641410.0.17763.6414
microsoftwindows_10_21h2< 10.0.19044.501110.0.19044.5011
microsoftwindows_10_22h2< 10.0.19045.501110.0.19045.5011
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.641410.0.17763.6414
microsoftwindows_10_version_21h2>= 10.0.19044.0 < 10.0.19044.501110.0.19044.5011
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.501110.0.19045.5011
microsoftwindows_11_21h2< 10.0.22000.326010.0.22000.3260
microsoftwindows_11_22h2< 10.0.22621.431710.0.22621.4317
microsoftwindows_11_23h2< 10.0.22631.431710.0.22631.4317
microsoftwindows_11_24h2< 10.0.26100.203310.0.26100.2033
microsoftwindows_11_version_21h2>= 10.0.22000.0 < 10.0.22000.326010.0.22000.3260
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.431710.0.22621.4317
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.431710.0.22631.4317
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.203310.0.26100.2033
microsoftwindows_11_version_26h1>= 10.0.28000.0 < 10.0.28000.226910.0.28000.2269
microsoftwindows_server_2019< 10.0.17763.641410.0.17763.6414
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.641410.0.17763.6414
microsoftwindows_server_2022< 10.0.20348.276210.0.20348.2762
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.276210.0.20348.2762
microsoftwindows_server_2022_23h2< 10.0.25398.118910.0.25398.1189
msrcwindows_10_version_1809
msrcwindows_10_version_21h2
msrcwindows_10_version_22h2
msrcwindows_11_version_21h2
msrcwindows_11_version_22h2

Detection & IOCsextracted from sources · hover to see the quote

  • Detect malformed packets sent to the RDP server's websocket listening port, which may indicate exploitation attempts targeting CVE-2024-43582
  • Monitor for race condition exploitation patterns against the RDP websocket service, as successful exploitation requires winning a race condition
  • Alert on specially crafted RPC packets sent to the Remote Desktop Protocol Server from unauthenticated remote sources
  • ·Exploitation is rated 'Less Likely' by Microsoft and requires winning a race condition (CVSS AC:H), reducing the practical risk of opportunistic exploitation
  • ·The vulnerability affects the RDP Server websocket service specifically; code execution occurs with the same permissions as the websocket service, not necessarily SYSTEM

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.