CVE-2024-38072
NULL Pointer Dereference (CWE-476)
Summary
A vulnerability in the Windows Remote Desktop Licensing Service could allow an attacker to cause a denial of service condition. This vulnerability is classified as a NULL Pointer Dereference (CWE-476). The attack vector is through the network, requires low attack complexity, and does not need user interaction or privileges.
Impact
If successfully exploited, this vulnerability could lead to a high impact on the availability of the affected system. The attack could cause the Windows Remote Desktop Licensing Service to crash or become unresponsive, potentially disrupting remote desktop services across the organization. However, there is no impact on the confidentiality or integrity of the system.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft released an update to address this vulnerability on July 9, 2024.
Mitigation
To mitigate this vulnerability, it is recommended to apply the security update provided by Microsoft as soon as possible. Prioritize patching for systems running Windows Server that have the Remote Desktop Licensing Service enabled. Additionally, network segmentation and access controls can be implemented to limit exposure of the affected service to untrusted networks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Timeline
Detection for the vulnerability has been added to Qualys (92149)
A CVSS base score of 7.5 has been assigned.
NVD published the first details for CVE-2024-38072
Feedly found the first article mentioning CVE-2024-38072. See article
Feedly estimated the CVSS score as MEDIUM
This CVE started to trend in security discussions
EPSS Score was set to: 0.05% (Percentile: 17.2%)
This CVE stopped trending in security discussions
CVE-2024-38072 is a critical Denial of Service vulnerability in the Windows Remote Desktop Licensing Service. It has a CVSS score of [insert score here]. The vulnerability is currently being exploited in the wild by [insert threat actor here], and there are no known mitigations or patches available at this time. Third-party vendors relying on this service may also be impacted. See article