CVE-2025-29959
📋 TL;DR
This vulnerability in Windows Routing and Remote Access Service (RRAS) allows attackers to read uninitialized memory contents, potentially exposing sensitive information like credentials or system data. It affects Windows systems with RRAS enabled and can be exploited over the network by unauthorized users.
💻 Affected Systems
- Windows Routing and Remote Access Service (RRAS)
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive memory contents including passwords, encryption keys, or other confidential data, leading to credential theft or further system compromise.
Likely Case
Information disclosure of random memory contents, potentially revealing system information or partial data that could aid other attacks.
If Mitigated
Limited information disclosure with no direct path to system compromise if proper network segmentation and access controls are in place.
🎯 Exploit Status
Requires network access to RRAS service but no authentication. Exploitation may require specific conditions to trigger the uninitialized resource.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29959
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates from Microsoft. 2. Verify RRAS service is updated. 3. Restart system if required by update.
🔧 Temporary Workarounds
Disable RRAS if not needed
windowsTurn off Routing and Remote Access Service if not required for business operations
sc config RemoteAccess start= disabled
net stop RemoteAccess
Network segmentation
windowsRestrict network access to RRAS service using firewall rules
New-NetFirewallRule -DisplayName "Block RRAS" -Direction Inbound -Protocol TCP -LocalPort 1723 -Action Block
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach RRAS service
- Monitor RRAS service logs for unusual access patterns or information disclosure attempts
🔍 How to Verify
Check if Vulnerable:
Check if RRAS service is enabled and running on Windows systems: Get-Service RemoteAccessCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows update KB number is installed and RRAS service version matches patched version📡 Detection & Monitoring
Log Indicators:
- Unusual RRAS service access patterns
- Failed or unusual RRAS connection attempts
- Event logs showing RRAS service errors
Network Indicators:
- Unexpected network traffic to RRAS ports (typically 1723 for PPTP)
- Information disclosure patterns in network traffic
SIEM Query:
source="windows" AND (service="RemoteAccess" OR event_id=20170) AND (src_ip NOT IN allowed_networks)