CVE-2024-43593: Windows Server 2008 RRAS RCE Vulnerability

CVE-2024-43593 Overview

CVE-2024-43593 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). Microsoft disclosed the flaw as part of its October 2024 security update cycle. The issue affects Windows Server releases from 2008 through 2022 (including 23H2), where RRAS is commonly enabled to provide VPN, dial-up, and network routing functionality. An authenticated attacker on the network can send crafted traffic to a vulnerable RRAS instance and execute arbitrary code in the context of the service. The weakness is classified under [CWE-20] Improper Input Validation.

Critical Impact
Successful exploitation grants remote code execution on affected Windows Server hosts running RRAS, compromising confidentiality, integrity, and availability of the server.

Affected Products

Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
Microsoft Windows Server 2012 and Windows Server 2012 R2
Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-10-08 - CVE-2024-43593 published to NVD alongside Microsoft's October 2024 security update
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-43593

Vulnerability Analysis

RRAS provides routing, VPN termination, and remote access services on Windows Server. The vulnerability arises when the service processes network-supplied input without adequate validation, leading to a memory state that allows attacker-controlled code execution. An attacker who can authenticate to the network and reach the RRAS interface can trigger the flaw with a crafted request. Once triggered, code runs in the security context of the RRAS service, which typically holds elevated privileges on the host. This gives attackers a path to lateral movement, credential theft, and persistence on domain-connected infrastructure.

Root Cause

Microsoft attributes the issue to improper input validation in RRAS, tracked under [CWE-20]. RRAS fails to correctly validate specific fields in incoming protocol traffic before using them in memory operations. The unchecked input causes the service to reach an unsafe execution state that an attacker can steer toward arbitrary code execution.

Attack Vector

Exploitation requires network access to a system running RRAS and low-privilege authenticated access. No user interaction is required, and attack complexity is low. The attacker sends a crafted network request to the target service, and the resulting code executes with the privileges of the RRAS process. Microsoft has not published exploitation details, and no public proof-of-concept has been observed. Technical specifics are described in prose because no verified exploit code is available. Refer to the Microsoft Security Update CVE-2024-43593 advisory for vendor guidance.

Detection Methods for CVE-2024-43593

Indicators of Compromise

Unexpected svchost.exe child processes spawned from the RRAS service host, such as command shells, powershell.exe, or rundll32.exe.
Anomalous inbound traffic to RRAS listeners on affected Windows Server systems, particularly from non-VPN clients.
RRAS service crashes, restarts, or Windows Error Reporting entries referencing the RemoteAccess service.

Detection Strategies

Baseline legitimate RRAS clients and alert on authenticated sessions originating from unexpected internal or external hosts.
Monitor process lineage for the RRAS service host to identify code execution originating from within svchost.exe hosting RemoteAccess.
Correlate Windows Security event logs for successful low-privilege authentications immediately followed by RRAS service errors or new process creation.

Monitoring Recommendations

Enable command-line auditing (Event ID 4688) and Windows Defender ATP-equivalent process telemetry on all RRAS servers.
Forward RRAS operational logs and System event log entries to a centralized SIEM for retention and correlation.
Track outbound network connections from RRAS servers to detect post-exploitation callbacks or lateral movement attempts.

How to Mitigate CVE-2024-43593

Immediate Actions Required

Apply Microsoft's October 2024 security update for every affected Windows Server SKU listed in the vendor advisory.
Inventory all servers with the RemoteAccess role installed and prioritize internet-adjacent or perimeter systems.
Restrict network access to RRAS management and VPN endpoints to trusted source ranges only.

Patch Information

Microsoft released fixes for CVE-2024-43593 in the October 8, 2024 Patch Tuesday cycle. Administrators should install the cumulative update that matches each affected Windows Server version. Refer to the Microsoft Security Update CVE-2024-43593 advisory for KB article numbers and download links per SKU.

Workarounds

If patching cannot be completed immediately, disable the Routing and Remote Access service on servers where it is not required for business operations.
Enforce network segmentation and firewall rules that block RRAS-related ports from untrusted networks.
Require multi-factor authentication and least-privilege accounts for any user that can reach RRAS endpoints, reducing the pool of attackers meeting the low-privilege prerequisite.

bash

# Configuration example: check for and disable the RRAS service on hosts where it is not needed
Get-Service -Name RemoteAccess | Select-Object Status, StartType
Stop-Service -Name RemoteAccess -Force
Set-Service -Name RemoteAccess -StartupType Disabled