CVE-2025-29961
📋 TL;DR
An out-of-bounds read vulnerability in Windows Routing and Remote Access Service (RRAS) allows unauthenticated attackers to read sensitive memory contents over the network. This affects Windows systems with RRAS enabled, potentially exposing system information or credentials. The vulnerability requires network access to the RRAS service.
💻 Affected Systems
- Windows Routing and Remote Access Service (RRAS)
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive memory contents including credentials, encryption keys, or other system information, leading to privilege escalation or lateral movement.
Likely Case
Information disclosure of system memory contents, potentially revealing configuration details or partial data that could aid further attacks.
If Mitigated
Limited information disclosure with no direct code execution, but still providing reconnaissance value to attackers.
🎯 Exploit Status
Exploitation requires network access to the RRAS service and understanding of the specific memory layout.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update for specific KB number
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29961
Restart Required: Yes
Instructions:
1. Apply the latest Windows security updates from Microsoft. 2. Ensure RRAS service is restarted after patching. 3. Verify the patch is applied using Windows Update history.
🔧 Temporary Workarounds
Disable RRAS Service
windowsTemporarily disable the Routing and Remote Access Service if not required
sc config RemoteAccess start= disabled
net stop RemoteAccess
Network Segmentation
windowsRestrict network access to RRAS service using firewall rules
netsh advfirewall firewall add rule name="Block RRAS" dir=in action=block protocol=TCP localport=1723,1701,47
🧯 If You Can't Patch
- Disable RRAS service if not essential for business operations
- Implement strict network access controls to limit exposure to RRAS service
🔍 How to Verify
Check if Vulnerable:
Check if RRAS service is running and compare Windows version against patched versions in Microsoft advisoryCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update history contains the relevant security update and RRAS service version📡 Detection & Monitoring
Log Indicators:
- Unusual RRAS service access attempts
- RRAS service crashes or errors in Event Viewer
Network Indicators:
- Unusual network traffic to RRAS ports (1723, 1701, 47)
- Multiple connection attempts to RRAS service
SIEM Query:
source="windows" AND (event_id=4625 OR event_id=4776) AND service_name="RemoteAccess"