CVE-2024-30015: Windows 10 1507 RRAS RCE Vulnerability

CVE-2024-30015 Overview

CVE-2024-30015 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw affects a broad range of Microsoft Windows client and server versions, from Windows 10 1507 through Windows 11 23H2 and Windows Server 2008 through Windows Server 2022 23H2. Microsoft published the advisory on May 14, 2024. The vulnerability is associated with CWE-197: Numeric Truncation Error. Exploitation requires user interaction and high attack complexity, but a successful attack can compromise confidentiality, integrity, and availability on the target host.

Critical Impact
A network-based attacker who convinces a user to interact with a crafted request or resource can execute code on a system running Windows RRAS, leading to full compromise of the affected host.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2, 23H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-05-14 - Microsoft releases security advisory for CVE-2024-30015
2024-05-14 - CVE-2024-30015 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30015

Vulnerability Analysis

CVE-2024-30015 is a remote code execution flaw in the Windows Routing and Remote Access Service (RRAS). RRAS provides routing, VPN, and dial-up connectivity services on Windows Server platforms and is optionally installed on client systems. The weakness maps to [CWE-197: Numeric Truncation Error], where a value is converted to a smaller data type and loses significant bits. Truncation errors in networking code can produce incorrect length calculations, undersized buffer allocations, and downstream memory corruption when the untruncated data is processed.

The advisory indicates that user interaction is required and the attack complexity is high. This suggests the attacker must coax a legitimate user into initiating or accepting a connection or into processing a malicious response, and must also win specific conditions such as timing or memory layout to reliably execute code.

Root Cause

The root cause is improper handling of numeric values within RRAS message processing. When an oversized or specially crafted value is truncated during conversion between integer widths, the resulting value no longer reflects the actual size of the data. Subsequent operations that rely on the truncated value can read or write outside allocated buffers, giving an attacker a primitive suitable for control-flow hijacking.

Attack Vector

The attack vector is network-based. An attacker sends crafted traffic to a host running RRAS, or persuades a user of an RRAS-enabled system to connect to an attacker-controlled endpoint. Successful exploitation yields code execution in the context of the RRAS service. Hosts without the Routing and Remote Access role installed and running are not exposed. Refer to the Microsoft Security Response Center advisory for vendor-supplied technical detail.

No public proof-of-concept exploit or entry in the CISA Known Exploited Vulnerabilities catalog is associated with this CVE at the time of writing.

Detection Methods for CVE-2024-30015

Indicators of Compromise

Unexpected crashes, restarts, or access violations in the RemoteAccess service or svchost.exe instances hosting RRAS
Child processes spawned by RRAS-related services that do not match known administrative behavior
Outbound network connections from RRAS host processes to unfamiliar external endpoints following inbound VPN or routing traffic

Detection Strategies

Monitor Windows Event Log for Service Control Manager entries showing repeated stops or failures of the Routing and Remote Access service
Alert on process creation events where RRAS-hosting svchost.exe instances launch shells, script interpreters, or LOLBins such as cmd.exe, powershell.exe, or rundll32.exe
Inspect network telemetry for anomalous PPTP, L2TP, SSTP, or IKEv2 negotiation patterns directed at RRAS endpoints

Monitoring Recommendations

Enable audit policies for service state changes and process creation with command-line logging on all Windows Servers with the Routing and Remote Access role
Baseline normal RRAS traffic volumes and connection sources so anomalous inbound negotiation attempts stand out
Forward RRAS host telemetry to a centralized SIEM or data lake for correlation with authentication and endpoint events

How to Mitigate CVE-2024-30015

Immediate Actions Required

Apply the May 2024 Microsoft security update that addresses CVE-2024-30015 across all affected Windows client and server versions
Inventory systems running the Routing and Remote Access role and prioritize patching internet-exposed hosts first
Restrict inbound network access to RRAS endpoints so only expected clients and management networks can reach the service

Patch Information

Microsoft released fixes as part of the May 14, 2024 Patch Tuesday cycle. The authoritative list of security updates per Windows version is available in the Microsoft advisory for CVE-2024-30015. Administrators should confirm the applicable KB article for each build using Windows Update, WSUS, or the Microsoft Update Catalog and verify installation with wmic qfe list or the Get-HotFix PowerShell cmdlet.

Workarounds

Disable the Routing and Remote Access service on hosts that do not require RRAS functionality
Place RRAS servers behind firewalls that limit exposure of VPN and routing protocol ports to trusted networks only
Enforce network segmentation so a compromised RRAS host cannot be used as a pivot into sensitive internal segments

bash

# Disable the Routing and Remote Access service on hosts that do not need it
sc.exe stop RemoteAccess
sc.exe config RemoteAccess start= disabled

# Verify patch installation (replace KB number with the update for your build)
Get-HotFix | Where-Object { $_.HotFixID -like 'KB50*' }