CVE-2019-0708:

A remote code execution vulnerability exists in Microsoft Windows Remote Desktop Services (RDP) that allows an unauthenticated attacker to connect to the target system and send specially crafted requests, known as the Remote Desktop Services Remote Code Execution Vulnerability (CVE-2019-0708).

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:May 16, 2019
CISA KEV Date:Nov 3, 2021
Industries Affected:20

Armis Early Warning:

902 Days

Threat Predictions

EPSS Score:94.5
EPSS Percentile:100%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Overview

CVE-2019-0708, commonly referred to as BlueKeep, is a critical remote code execution flaw in Microsoft Windows Remote Desktop Services that could be exploited over a network by unauthenticated attackers who send crafted RDP requests, potentially allowing full control of affected systems. The issue affects multiple Windows client and server editions listed as affected, including Windows 7 Service Pack 1 (32-bit and x64) and various Windows Server 2008/2008 R2 configurations.

Remediation

Apply the Microsoft security updates that fix CVE-2019-0708 to all affected Windows editions (Windows 7 SP1, Windows Server 2008/2008 R2 SP1, including core installations where applicable) via Windows Update, WSUS, or enterprise software deployment tooling.
Enable Network Level Authentication (NLA) for Remote Desktop and require authentication before establishing an RDP session.
Restrict RDP exposure to trusted networks only: block RDP (port 3389) from the internet at the firewall, or place RDP behind a VPN or Remote Desktop Gateway.
If RDP must be accessible, enforce strong authentication (prefer VPN + MFA) and consider enabling additional protections such as RD Gateway and IP allowlists.
Disable RDP on systems that do not require it, or isolate unpatched/unsupported hosts from the network until patching is completed.
Maintain an ongoing patch management process to ensure all affected systems remain up to date and regularly monitor for exploit attempts and related indicators of compromise.
Validate patches in a testing environment before broad deployment and verify successful remediation across all affected endpoints.