Cyber Resilience

CVE-2024-43454

High

Published: 10 September 2024

Published
10 September 2024
Modified
13 September 2024
KEV Added
Patch
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
EPSS Score 0.2883 96.7th percentile
Risk Priority 31 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-43454 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.1 (High).

Operationally, ranked in the top 3.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-43454 is a remote code execution vulnerability affecting the Windows Remote Desktop Licensing Service. It carries a CVSS 3.1 base score of 7.1 and is associated with CWE-23 relative path traversal. The flaw permits an authenticated network attacker to influence the integrity of the service with high impact and limited availability consequences.

An attacker possessing low privileges can reach the service over the network with no user interaction required. Successful exploitation allows modification of protected resources and partial disruption of service availability while leaving confidentiality unaffected.

The Microsoft Security Response Center advisory published for CVE-2024-43454 provides official guidance on available patches and mitigation steps. The current EPSS score of 0.2883 indicates notable exploitation interest since disclosure.

EU & UK References

Vulnerability details

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows server 2008
all versions, r2, sp2
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.7336
microsoft
windows server 2019
≤ 10.0.17763.6293
microsoft
windows server 2022
≤ 10.0.20348.2700
microsoft
windows server 2022 23h2
≤ 10.0.25398.1128

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References