CVE-2019-0708
CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Microsoft Remote Desktop Services
PublishedMay 16, 2019
First seenMay 16, 2019
Added to KEVNov 3, 2021
Weakness typeCWE-416Use after free
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: May 3, 2022Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft windows_7 | No range specified | — |
| microsoft windows_server_2008 | No range specified, r2 | — |
| siemens axiom_multix_m_firmware | No range specified | — |
| siemens axiom_vertix_md_trauma_firmware | No range specified | — |
| siemens axiom_vertix_solitaire_m_firmware | No range specified | — |
| siemens mobilett_xp_digital_firmware | No range specified | — |
| siemens multix_pro_acss_p_firmware | No range specified | — |
| siemens multix_pro_p_firmware | No range specified | — |
| siemens multix_pro_firmware | No range specified | — |
| siemens multix_pro_acss_firmware | No range specified | — |
| siemens multix_pro_navy_firmware | No range specified | — |
| siemens multix_swing_firmware | No range specified | — |
| siemens multix_top_firmware | No range specified | — |
| siemens multix_top_acss_firmware | No range specified | — |
| siemens multix_top_p_firmware | No range specified | — |
| siemens multix_top_acss_p_firmware | No range specified | — |
| siemens vertix_solitaire_firmware | No range specified | — |
| siemens atellica_solution_firmware | No range specified | — |
| siemens aptio_firmware | No range specified | — |
| siemens streamlab_firmware | No range specified | — |
| siemens centralink_firmware | No range specified | — |
| siemens viva_e_firmware | No range specified | — |
| siemens viva_twin_firmware | No range specified | — |
| siemens syngo_lab_process_manager | No range specified | — |
| siemens rapidpoint_500_firmware | v ≤ 2.3.2 | — |
| siemens lantis_firmware | No range specified | — |
| huawei agile_controller-campus_firmware | v100r002c00, v100r002c10 | — |
| huawei bh620_v2_firmware | v100r002c00 | — |
| huawei bh621_v2_firmware | v100r002c00 | — |
| huawei bh622_v2_firmware | v100r001c00 | — |
| huawei bh640_v2_firmware | v100r002c00 | — |
| huawei ch121_firmware | v100r001c00 | — |
| huawei ch140_firmware | v100r001c00 | — |
| huawei ch220_firmware | v100r001c00 | — |
| huawei ch221_firmware | v100r001c00 | — |
| huawei ch222_firmware | v100r002c00 | — |
| huawei ch240_firmware | v100r001c00 | — |
| huawei ch242_firmware | v100r001c00 | — |
| huawei ch242_v3_firmware | v100r001c00 | — |
| huawei e6000_firmware | v100r002c00 | — |
| huawei e6000_chassis_firmware | v100r001c00 | — |
| huawei gtsoftx3000_firmware | v200r001c01spc100, v200r002c00spc300, v200r002c10spc100 | — |
| huawei oceanstor_18500_firmware | v100r001c30spc300 | — |
| huawei oceanstor_18800_firmware | v100r001c30spc300 | — |
| huawei oceanstor_18800f_firmware | v100r001c30spc300 | — |
| huawei oceanstor_hvs85t_firmware | v100r001c00, v100r001c30spc200 | — |
| huawei oceanstor_hvs88t_firmware | v100r001c00, v100r001c30spc200 | — |
| huawei rh1288_v2_firmware | v100r002c00 | — |
| huawei rh1288a_v2_firmware | v100r002c00 | — |
| huawei rh2265_v2_firmware | v100r002c00 | — |
| huawei rh2268_v2_firmware | v100r002c00 | — |
| huawei rh2285_v2_firmware | v100r002c00 | — |
| huawei rh2285h_v2_firmware | v100r002c00 | — |
| huawei rh2288_v2_firmware | v100r002c00 | — |
| huawei rh2288a_v2_firmware | v100r002c00 | — |
| huawei rh2288e_v2_firmware | v100r002c00 | — |
| huawei rh2288h_v2_firmware | v100r002c00 | — |
| huawei rh2485_v2_firmware | v100r002c00 | — |
| huawei rh5885_v2_firmware | v100r001c00 | — |
| huawei rh5885_v3_firmware | v100r003c00 | — |
| huawei smc2.0_firmware | v500r002c00, v600r006c00 | — |
| huawei seco_vsm_firmware | v200r002c00 | — |
| huawei uma_firmware | v200r001c00, v300r001c00 | — |
| huawei x6000_firmware | v100r002c00 | — |
| huawei x8000_firmware | v100r002c20 | — |
| huawei elog_firmware | v200r003c10 | — |
| huawei espace_ecs_firmware | v300r001c00 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.