CVE-2025-58717
📋 TL;DR
An out-of-bounds read vulnerability in Windows Routing and Remote Access Service (RRAS) allows unauthorized attackers to read memory contents they shouldn't access, potentially exposing sensitive information. This affects Windows systems with RRAS enabled, particularly those configured for VPN or routing services.
💻 Affected Systems
- Windows Routing and Remote Access Service
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
Windows 11 25h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive memory contents including credentials, encryption keys, or other system data, leading to further compromise of the system or network.
Likely Case
Information disclosure of system memory contents, potentially revealing configuration details or partial data that could aid in further attacks.
If Mitigated
Limited information disclosure with no direct code execution or system compromise.
🎯 Exploit Status
Requires network access to RRAS service. No authentication needed but requires specific conditions to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update for specific KB number
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-58717
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates from Microsoft. 2. Verify RRAS service is updated. 3. Restart system if required by the update.
🔧 Temporary Workarounds
Disable RRAS if not needed
WindowsDisable Routing and Remote Access Service if it's not required for business operations
sc config RemoteAccess start= disabled
net stop RemoteAccess
Restrict network access to RRAS
WindowsUse firewall rules to limit which systems can access RRAS ports
netsh advfirewall firewall add rule name="Block RRAS" dir=in action=block protocol=TCP localport=1723,1701,47
🧯 If You Can't Patch
- Implement strict network segmentation to isolate RRAS systems
- Monitor RRAS service logs for unusual activity or connection attempts
🔍 How to Verify
Check if Vulnerable:
Check if RRAS is enabled and running, then verify Windows version against patched versions in Microsoft advisoryCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update history shows the relevant security update installed and RRAS service version📡 Detection & Monitoring
Log Indicators:
- Unusual RRAS service errors
- Multiple failed connection attempts to RRAS
- Memory access violations in system logs
Network Indicators:
- Unusual traffic patterns to RRAS ports (1723, 1701, 47)
- Multiple connection attempts from single sources
SIEM Query:
EventID=4625 OR EventID=4688 | where ProcessName contains "svchost" AND CommandLine contains "rras"