CVE-2025-21309
Published: 14 January 2025
Summary
CVE-2025-21309 is a high-severity Sensitive Data Storage in Improperly Locked Memory (CWE-591) vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-17 (Remote Access).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the RCE vulnerability by requiring timely remediation through application of vendor patches for Windows Remote Desktop Services.
Provides boundary protection to restrict network access to vulnerable RDS ports, limiting remote exploitation opportunities.
Controls and monitors remote access usage for RDS services, reducing unauthorized exposure and enabling detection of anomalous connections.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated network RCE in Windows Remote Desktop Services, directly mapping to exploitation of public-facing applications (T1190) and remote services (T1210) for initial access or lateral movement.
NVD Description
Windows Remote Desktop Services Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21309 is a Remote Code Execution vulnerability in Windows Remote Desktop Services. Published on 2025-01-14T18:15:54.210, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-591 as well as NVD-CWE-noinfo.
Unauthenticated remote attackers can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation enables remote code execution with high impacts on confidentiality, integrity, and availability within the affected scope.
The Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21309 details available patches and mitigation recommendations.
Details
- CWE(s)