CVE-2024-49075: Windows 10 1809 RDS DoS Vulnerability

CVE-2024-49075 Overview

CVE-2024-49075 is a denial of service vulnerability in Windows Remote Desktop Services. The flaw allows unauthenticated remote attackers to disrupt the availability of affected systems through network-based requests. Microsoft published the advisory on December 12, 2024 as part of its monthly security update cycle.

The weakness is classified as uncontrolled resource consumption [CWE-400]. Successful exploitation does not compromise confidentiality or integrity but can interrupt service for legitimate Remote Desktop users. The vulnerability affects multiple supported Windows client and server releases, including Windows 11 24H2 and Windows Server 2025.

Critical Impact
Unauthenticated attackers can exhaust Remote Desktop Services resources over the network, causing service outages on Windows endpoints and servers exposing RDP.

Affected Products

Microsoft Windows 10 versions 1809, 21H2, and 22H2
Microsoft Windows 11 versions 22H2, 23H2, and 24H2
Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2024-12-12 - CVE-2024-49075 published to NVD by Microsoft
2025-01-08 - Last updated in NVD database

Technical Details for CVE-2024-49075

Vulnerability Analysis

The vulnerability resides within Windows Remote Desktop Services, the component that handles RDP session establishment and management. An unauthenticated attacker can send crafted requests over the network to a target running Remote Desktop Services. The service fails to control resource consumption while processing these requests, leading to a denial of service condition.

No user interaction is required, and the attacker does not need prior credentials. The flaw affects only availability. Confidentiality and integrity remain intact according to the Microsoft advisory.

Root Cause

The underlying weakness is uncontrolled resource consumption tracked as [CWE-400]. Remote Desktop Services does not adequately bound the resources consumed when handling specific protocol interactions. Repeated or malformed requests cause the service to exhaust memory, CPU, or connection state, terminating legitimate sessions.

Attack Vector

The attack vector is network-based and targets TCP port 3389 by default, or any port where the Remote Desktop gateway or session host is exposed. Exposure increases significantly when RDP endpoints are reachable from the public internet or untrusted network segments. EPSS data places exploitation likelihood at 2.537%, in the 82nd percentile, indicating elevated relative risk compared with most CVEs.

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed at the time of writing. Refer to the Microsoft Security Update CVE-2024-49075 advisory for protocol-level technical details.

Detection Methods for CVE-2024-49075

Indicators of Compromise

Sudden termination or repeated crashes of the TermService (Remote Desktop Services) Windows service
Spikes in inbound RDP connection attempts from a small number of source IP addresses
High memory or CPU consumption tied to svchost.exe instances hosting Remote Desktop Services
Event Log entries showing abnormal RDP session disconnections in the Microsoft-Windows-TerminalServices-LocalSessionManager/Operational channel

Detection Strategies

Monitor Windows Event IDs 1006, 1015, and 4625 alongside RDP service restarts to identify abuse patterns
Correlate network flow data with TermService state changes to detect resource exhaustion attempts
Baseline normal RDP session volume per host and alert on deviations exceeding expected thresholds

Monitoring Recommendations

Forward Windows Security and TerminalServices event logs to a centralized analytics platform for correlation across hosts
Track external exposure of TCP port 3389 with continuous attack surface monitoring
Alert on repeated TermService crashes or restarts within short time windows

How to Mitigate CVE-2024-49075

Immediate Actions Required

Apply the December 2024 Microsoft security updates to all affected Windows client and server versions
Restrict inbound RDP access to trusted management networks using firewall rules or VPN gateways
Require Network Level Authentication (NLA) on all Remote Desktop hosts to limit unauthenticated protocol processing
Inventory internet-exposed RDP endpoints and prioritize patching for any externally reachable systems

Patch Information

Microsoft released patches for all affected products through the December 12, 2024 Patch Tuesday cycle. Administrators should consult the Microsoft Security Update CVE-2024-49075 advisory for the specific KB article corresponding to each Windows build and apply updates through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Place Remote Desktop hosts behind a Remote Desktop Gateway and enforce multi-factor authentication at the gateway
Disable Remote Desktop Services on systems that do not require it using Set-Service -Name TermService -StartupType Disabled
Apply rate limiting and geofencing at network edge devices to reduce unauthenticated RDP traffic volume
Segment management interfaces from production network paths to reduce blast radius if a host is impacted

bash

# Configuration example: block external RDP via Windows Firewall
New-NetFirewallRule -DisplayName "Block-Inbound-RDP-External" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 3389 \
  -RemoteAddress Internet \
  -Action Block