CVE-2024-30023: Windows 10 1507 RRAS RCE Vulnerability

CVE-2024-30023 Overview

CVE-2024-30023 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw affects a broad range of Microsoft Windows client and server operating systems, including Windows 10, Windows 11, and Windows Server editions from 2008 through 2022 23H2. Microsoft classifies this issue under [CWE-197] (Numeric Truncation Error), which can lead to memory corruption when oversized values are improperly converted. Successful exploitation allows an attacker to execute arbitrary code on a vulnerable system that has RRAS enabled.

Critical Impact
An attacker who successfully exploits this vulnerability can achieve remote code execution against systems running the Routing and Remote Access Service, impacting confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-05-14 - CVE-2024-30023 published to NVD
2024-05-14 - Microsoft releases security update for CVE-2024-30023
2025-01-08 - Last updated in NVD database

Technical Details for CVE-2024-30023

Vulnerability Analysis

The vulnerability resides within the Windows Routing and Remote Access Service, a Microsoft component that provides routing, VPN, and dial-up connectivity services. RRAS processes network traffic for remote clients, and certain protocol handlers in the service contain a numeric truncation flaw classified as [CWE-197]. When the service converts values between different integer sizes, a truncation can occur that misrepresents buffer sizes or offsets during subsequent operations.

Exploitation requires user interaction and a high level of attack complexity, which suggests the attacker must win a race condition or coerce a user action to reach the vulnerable code path. Once triggered, the truncation leads to memory corruption that an attacker can leverage to execute arbitrary code in the context of the RRAS service.

Root Cause

The root cause is improper handling of integer values during protocol message processing in RRAS. A larger numeric value is truncated to a smaller type, producing an incorrect length or offset. The resulting mismatch between expected and actual buffer sizes leads to memory corruption that an attacker can shape into code execution.

Attack Vector

The attack vector is network-based against systems configured as RRAS servers. An attacker sends specially crafted protocol traffic to the RRAS endpoint to trigger the truncation flaw. Exploitation depends on user interaction, which constrains practical attack scenarios but does not eliminate them in environments where administrators or users initiate RRAS connections. The EPSS score is 1.776% (83rd percentile), indicating elevated exploitation likelihood relative to most CVEs.

No public proof-of-concept code or exploitation in the wild has been documented for this issue. See the Microsoft CVE-2024-30023 Advisory for technical details.

Detection Methods for CVE-2024-30023

Indicators of Compromise

Unexpected RemoteAccess service crashes or restarts recorded in the Windows Service Control Manager event log
Anomalous inbound traffic to RRAS-related ports such as UDP/500, UDP/4500, TCP/1723, and protocol 47 (GRE)
Unexplained child processes spawned by svchost.exe hosting the RemoteAccess service
New listening sockets or outbound connections initiated from the RRAS service context

Detection Strategies

Monitor process lineage for svchost.exe instances hosting RemoteAccess and flag any non-standard child processes
Inspect VPN and tunneling protocol traffic for malformed packets targeting RRAS listeners
Correlate RRAS service crash events (Event ID 7031, 7034) with inbound network sessions from untrusted sources
Apply behavioral analytics to detect post-exploitation activity originating from the RRAS service account

Monitoring Recommendations

Enable Windows Event Forwarding for System, Security, and RRAS-specific operational logs to a centralized SIEM
Track network flows to and from systems with RRAS enabled and baseline normal traffic patterns
Alert on creation of scheduled tasks, services, or accounts shortly after RRAS service anomalies
Audit which servers expose RRAS to untrusted networks and shrink the attack surface where possible

How to Mitigate CVE-2024-30023

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2024-30023 Advisory to all affected Windows client and server systems
Inventory all systems with the Routing and Remote Access role enabled and prioritize patching internet-exposed hosts
Restrict access to RRAS endpoints using firewall rules that allow only known VPN clients and management hosts
Disable the RemoteAccess service on systems that do not require routing or VPN functionality

Patch Information

Microsoft published patches for CVE-2024-30023 as part of the May 2024 Patch Tuesday release. Administrators should consult the Microsoft CVE-2024-30023 Advisory for the specific KB articles corresponding to each affected Windows version and apply the updates through Windows Update, WSUS, or the Microsoft Update Catalog.

Workarounds

Disable the Routing and Remote Access service on hosts where it is not required
Block inbound traffic to RRAS ports (TCP/1723, UDP/500, UDP/4500, protocol 47) at the network perimeter for untrusted sources
Place RRAS servers behind a VPN concentrator or jump host that restricts which clients can initiate connections
Segment networks so that RRAS endpoints are not reachable from general user or guest VLANs

bash

# Configuration example - disable RRAS where not required (PowerShell)
Stop-Service -Name RemoteAccess -Force
Set-Service -Name RemoteAccess -StartupType Disabled

# Restrict inbound PPTP access at the Windows firewall
New-NetFirewallRule -DisplayName "Block PPTP Inbound" -Direction Inbound -Protocol TCP -LocalPort 1723 -Action Block