CVE-2024-38115: Windows 10 1507 RCE Vulnerability

CVE-2024-38115 Overview

CVE-2024-38115 is a remote code execution vulnerability in the Windows IP Routing Management Snapin. Microsoft disclosed the flaw as part of its August 2024 security update cycle. The vulnerability affects a broad range of Windows client and server editions, including Windows 10, Windows 11, and Windows Server releases from 2008 through 2022 23H2.

The weakness is tracked under [CWE-122] (heap-based buffer overflow) and requires user interaction to trigger. Successful exploitation allows an attacker to execute arbitrary code in the context of the affected process, leading to full compromise of confidentiality, integrity, and availability.

Critical Impact
A network-based attacker who convinces a user to perform a specific action can execute arbitrary code on the target host, gaining the ability to install programs, modify data, or create new accounts.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-08-13 - Microsoft publishes advisory and security update for CVE-2024-38115
2024-08-13 - CVE-2024-38115 published to the National Vulnerability Database
2024-08-16 - Last updated in the NVD database

Technical Details for CVE-2024-38115

Vulnerability Analysis

The flaw resides in the Windows IP Routing Management Snapin, a Microsoft Management Console (MMC) component used to configure Routing and Remote Access (RRAS) services. The snapin contains a heap-based buffer overflow ([CWE-122]) reachable through crafted input handled by the management interface.

Attack complexity is low and no privileges are required, but the attacker must persuade a user to open or interact with a malicious artifact. The resulting code executes in the user's context on the targeted Windows host, granting attackers a foothold suitable for lateral movement against domain-joined systems.

Root Cause

The root cause is improper validation of input size or structure when the IP Routing Management Snapin allocates and populates heap buffers. Maliciously crafted configuration data or management payloads overflow an adjacent heap region, corrupting control structures the snapin later dereferences.

Attack Vector

The attack vector is network-based but gated by user interaction. A common scenario involves delivering a malicious management console file (.msc) or configuration artifact through phishing, file shares, or a compromised web resource. When an administrator opens the artifact, the snapin parses attacker-supplied data and triggers the heap overflow, leading to arbitrary code execution.

No public proof-of-concept exploit has been catalogued in ExploitDB, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. EPSS data indicates an elevated likelihood of exploitation relative to the broader CVE population.

No verified public exploit code is available. See the Microsoft Security Update Guide for CVE-2024-38115 for vendor technical details.

Detection Methods for CVE-2024-38115

Indicators of Compromise

Unexpected execution of mmc.exe loading the IP Routing Management Snapin (ipxmontr.dll, rasmontr.dll) from user-writable paths or via email attachments.
Crash events or Windows Error Reporting entries referencing the IP Routing Management Snapin shortly before suspicious child process creation.
.msc files delivered via email, browser downloads, or removable media that target routing or RRAS management.
Spawning of cmd.exe, powershell.exe, or rundll32.exe as child processes of mmc.exe following snapin interaction.

Detection Strategies

Monitor process lineage where mmc.exe spawns command interpreters or script hosts, which is rare in normal administrative workflows.
Hunt for newly written .msc files in user profile directories, mail download folders, and temporary paths.
Apply behavioral identification of heap corruption indicators in MMC-hosted processes, including access violations followed by code execution attempts.
Correlate snapin loads with outbound network connections to non-corporate destinations to surface staged payload retrieval.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block child process creation from Office and management tooling.
Forward Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) to a centralized analytics platform for retrospective hunting.
Track patch deployment coverage for the August 2024 Windows cumulative updates across all in-scope hosts.
Alert on administrative MMC sessions launched outside change windows or originating from non-privileged workstations.

How to Mitigate CVE-2024-38115

Immediate Actions Required

Apply the August 2024 Microsoft security updates that address CVE-2024-38115 across all affected Windows client and server systems.
Prioritize patching on systems running Routing and Remote Access Service (RRAS) and on administrative workstations used by network engineers.
Restrict delivery of .msc files through email gateways, web proxies, and removable media controls.
Audit accounts authorized to interact with the IP Routing Management Snapin and enforce least privilege.

Patch Information

Microsoft released fixes via the August 13, 2024 monthly security update. Refer to the Microsoft Security Update Guide for CVE-2024-38115 for KB articles aligned with each supported Windows build. Install the cumulative update appropriate to each operating system version and reboot to complete remediation.

Workarounds

Block opening of .msc attachments at the secure email gateway and quarantine inbound mail containing them.
Use AppLocker or Windows Defender Application Control to restrict mmc.exe execution to authorized administrators only.
Disable the Routing and Remote Access service on hosts that do not require it to reduce the attack surface.
Train administrators to verify the source and integrity of management console files before opening them.

bash

# Configuration example: disable the Routing and Remote Access service where unused
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess

# Verify the August 2024 cumulative update is installed
wmic qfe list brief /format:table | findstr /i "2024"