CVE-2024-43611: Windows Server 2008 RRAS RCE Vulnerability

CVE-2024-43611 Overview

CVE-2024-43611 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw affects multiple Windows Server releases spanning Server 2008 through Server 2022 23H2. An authenticated attacker with low privileges can send a crafted network request to a system running RRAS and execute arbitrary code. Microsoft classifies the issue under [CWE-20] Improper Input Validation. The vulnerability carries a CVSS 3.1 base score of 8.8 and does not require user interaction. The current EPSS probability sits at 1.80% (76th percentile), indicating moderate exploit likelihood relative to the broader CVE population.

Critical Impact
A network-adjacent attacker with low-privileged credentials can achieve remote code execution on Windows Servers running RRAS, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Windows Server 2008 SP2 (x86, x64) and Server 2008 R2 SP1
Microsoft Windows Server 2012 and Server 2012 R2
Microsoft Windows Server 2016, Server 2019, Server 2022, and Server 2022 23H2

Discovery Timeline

2024-10-08 - CVE-2024-43611 published to NVD as part of Microsoft's October 2024 Patch Tuesday
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43611

Vulnerability Analysis

Routing and Remote Access Service (RRAS) is a Windows Server role that provides routing, VPN, and dial-up remote access. RRAS listens for management and protocol traffic and parses complex network structures from remote clients. CVE-2024-43611 stems from improper input validation within RRAS request handling. When a low-privileged attacker sends a crafted request to a vulnerable RRAS instance, the service processes attacker-controlled data without adequate boundary or type checks. The resulting corruption allows execution of arbitrary code in the context of the RRAS service, which typically runs with high privileges on the host. Because RRAS is a network-facing role, exploitation does not require local access or user interaction. The scope remains unchanged, but full compromise of the host is possible on successful exploitation.

Root Cause

Microsoft attributes the vulnerability to improper input validation ([CWE-20]) inside RRAS. RRAS does not sufficiently validate fields in requests it processes, allowing malformed input to alter execution flow. Microsoft has not published low-level technical specifics such as the vulnerable function or protocol structure. The Microsoft Security Update Guide is the authoritative source.

Attack Vector

Exploitation requires network access to the RRAS endpoint and a set of low-privileged credentials on the target. The attacker sends a specially crafted request to the RRAS service, triggering the input validation flaw and gaining code execution. No user interaction is required. Servers exposing RRAS to untrusted networks face the greatest risk. No public proof-of-concept exploit and no evidence of in-the-wild exploitation have been recorded at the time of this writing, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code is available. See the Microsoft Security Update Guide for vendor guidance.

Detection Methods for CVE-2024-43611

Indicators of Compromise

Unexpected child processes spawned by svchost.exe hosting the RemoteAccess service, particularly cmd.exe, powershell.exe, or rundll32.exe.
Crashes or repeated restarts of the Routing and Remote Access service in the System event log.
Inbound connections to RRAS-related ports from unusual sources, including administrative interfaces not normally exposed.
Creation of new local accounts, scheduled tasks, or services on RRAS hosts shortly after suspicious network traffic.

Detection Strategies

Inventory all Windows Servers with the Routing and Remote Access role enabled and correlate against installed October 2024 cumulative updates.
Deploy endpoint identification rules that flag anomalous process ancestry from the RRAS service host.
Monitor network telemetry for unauthenticated or low-privileged sessions attempting RRAS management operations from non-administrative subnets.
Baseline normal RRAS traffic patterns and alert on protocol anomalies or malformed requests.

Monitoring Recommendations

Enable Windows Advanced Auditing for process creation (Event ID 4688) on all RRAS hosts.
Forward RRAS host telemetry to a centralized data lake for retention and cross-source correlation.
Track authentication events from low-privileged accounts targeting RRAS servers and alert on lateral movement patterns.
Review firewall logs for RRAS ports and restrict management interfaces to known administrative source addresses.

How to Mitigate CVE-2024-43611

Immediate Actions Required

Apply the October 2024 Microsoft security updates to all affected Windows Server versions listed in the Microsoft Security Update Guide.
Identify servers with the RRAS role enabled and prioritize patching for internet-facing or DMZ-hosted systems.
Rotate credentials for accounts with access to RRAS hosts, as exploitation requires low-privileged authentication.
Restrict inbound access to RRAS management interfaces using host and network firewalls.

Patch Information

Microsoft released fixes for CVE-2024-43611 during the October 2024 Patch Tuesday cycle. Administrators should install the cumulative update matching each server's Windows version. Refer to the Microsoft Security Update Guide for KB article numbers and download links specific to Server 2008 through Server 2022 23H2.

Workarounds

Disable the Routing and Remote Access service on servers that do not require routing, VPN, or dial-up remote access functionality.
Segment RRAS servers into isolated network zones and permit management traffic only from trusted administrative hosts.
Enforce strong authentication and remove unnecessary low-privileged accounts from systems running RRAS until patches can be applied.

bash

# Check whether the Routing and Remote Access service is running, and disable it if not required
Get-Service -Name RemoteAccess
Stop-Service -Name RemoteAccess -Force
Set-Service -Name RemoteAccess -StartupType Disabled