CVE-2025-21330
Published: 14 January 2025
Summary
CVE-2025-21330 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 19.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2025-21330 is a denial-of-service vulnerability in Windows Remote Desktop Services, assigned CWE-400 and carrying a CVSS 3.1 base score of 7.5. The flaw permits an unauthenticated network attacker to trigger excessive resource consumption that disrupts service availability without affecting confidentiality or integrity.
An attacker with network reachability can send crafted requests that exploit the weakness, causing the Remote Desktop Services component to become unresponsive. No user interaction or credentials are required, and the attack surface is exposed by default on systems listening for RDP traffic.
Microsoft’s advisory at the referenced MSRC link addresses the issue through available security updates. The EPSS score rose from a low baseline to a recorded peak of 0.0332, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2395
Vulnerability details
Windows Remote Desktop Services Denial of Service Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated DoS in Windows Remote Desktop Services via resource exhaustion (CWE-400), directly enabling T1499.004 (Application or System Exploitation) to crash/deny availability of the service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation including patching the specific Windows Remote Desktop Services vulnerability, directly eliminating the uncontrolled resource consumption issue.
SC-5 implements denial-of-service protections at network entry points to block unauthenticated remote attacks exploiting the RDS DoS vulnerability.
SC-6 enforces resource allocation policies and monitors for exhaustion conditions to mitigate CWE-400 uncontrolled resource consumption in Remote Desktop Services.