CVE-2025-64678
📋 TL;DR
A heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS) allows remote unauthenticated attackers to execute arbitrary code on affected systems. This affects Windows servers and workstations with RRAS enabled, potentially allowing complete system compromise over the network.
💻 Affected Systems
- Windows Routing and Remote Access Service (RRAS)
📦 What is this software?
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
Windows 11 25h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, lateral movement within the network, and potential ransomware deployment or data exfiltration.
Likely Case
Remote code execution resulting in system compromise, installation of backdoors, credential theft, and network persistence.
If Mitigated
Limited impact if network segmentation, firewalls, and proper access controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires network access to RRAS service. No authentication needed for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64678
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates from Microsoft
2. Restart affected systems
3. Verify RRAS service is running with patched version
🔧 Temporary Workarounds
Disable RRAS Service
windowsTemporarily disable Routing and Remote Access Service if not required
sc config RemoteAccess start= disabled
net stop RemoteAccess
Network Segmentation
allRestrict network access to RRAS service using firewalls
🧯 If You Can't Patch
- Implement strict network segmentation to isolate RRAS servers
- Deploy intrusion prevention systems with CVE-specific signatures
- Monitor for exploitation attempts and anomalous RRAS traffic
🔍 How to Verify
Check if Vulnerable:
Check if RRAS is enabled and running on Windows systems. Review system logs for RRAS service status.Check Version:
wmic service where name='RemoteAccess' get name,pathname,startmodeVerify Fix Applied:
Verify Windows Update history contains the relevant security patch. Check RRAS service version matches patched release.📡 Detection & Monitoring
Log Indicators:
- Unusual RRAS service crashes or restarts
- Suspicious network connections to RRAS ports
- Unexpected process creation from RRAS service
Network Indicators:
- Anomalous traffic patterns to RRAS ports (typically TCP 1723, UDP 1701)
- Exploit-like payloads in network traffic to RRAS services
SIEM Query:
source="windows" AND (event_id=7031 OR event_id=7034) AND service_name="RemoteAccess"