CVE-2024-30094
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Windows systems running Routing and Remote Access Service (RRAS) by sending specially crafted packets. It affects Windows servers and workstations with RRAS enabled, potentially allowing attackers to gain SYSTEM privileges on vulnerable systems.
💻 Affected Systems
- Windows Routing and Remote Access Service (RRAS)
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of malware, data theft, lateral movement, and persistent backdoors.
Likely Case
Remote code execution leading to ransomware deployment, credential harvesting, or botnet recruitment.
If Mitigated
Limited impact if network segmentation restricts RRAS traffic and proper patching is implemented.
🎯 Exploit Status
Microsoft rates this as 'Exploitation More Likely' in their advisory. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply May 2024 security updates or later
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30094
Restart Required: Yes
Instructions:
1. Apply May 2024 Windows security updates via Windows Update. 2. For enterprise: Deploy via WSUS, SCCM, or Microsoft Update Catalog. 3. Restart affected systems after patch installation.
🔧 Temporary Workarounds
Disable RRAS Service
windowsStop and disable the Routing and Remote Access Service if not required
sc stop RemoteAccess
sc config RemoteAccess start= disabled
Block RRAS Ports
windowsBlock network access to RRAS ports (TCP 1723, UDP 1701, UDP 500, UDP 4500)
netsh advfirewall firewall add rule name="Block RRAS" dir=in action=block protocol=TCP localport=1723
netsh advfirewall firewall add rule name="Block RRAS UDP" dir=in action=block protocol=UDP localport=1701,500,4500
🧯 If You Can't Patch
- Disable RRAS service completely if not required for business operations
- Implement strict network segmentation to isolate RRAS servers from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check if RRAS service is running: 'sc query RemoteAccess' and verify Windows version is unpatchedCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify May 2024 security updates are installed via 'systeminfo' or Windows Update history📡 Detection & Monitoring
Log Indicators:
- Event ID 4688 with RRAS process creation
- Unexpected RRAS service restarts
- Windows Security logs showing SYSTEM privilege escalation
Network Indicators:
- Unusual traffic to RRAS ports (1723, 1701, 500, 4500) from unexpected sources
- Malformed packets to RRAS service
SIEM Query:
source="windows" AND (event_id=4688 AND process_name="*rras*" OR service_name="RemoteAccess")