Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Windows Server 2008 R2 Service Pack 1 | affected |
|
||||||
| Microsoft | Windows Server 2008 R2 Service Pack 1 (Server Core installation) | affected |
|
||||||
| Microsoft | Windows Server 2008 Service Pack 2 | affected |
|
||||||
| Microsoft | Windows Server 2008 Service Pack 2 (Server Core installation) | affected |
|
||||||
| Microsoft | Windows Server 2012 | affected |
|
||||||
| Microsoft | Windows Server 2012 (Server Core installation) | affected |
|
||||||
| Microsoft | Windows Server 2012 R2 | affected |
|
||||||
| Microsoft | Windows Server 2012 R2 (Server Core installation) | affected |
|
||||||
| Microsoft | Windows Server 2016 | affected |
|
||||||
| Microsoft | Windows Server 2016 (Server Core installation) | affected |
|
||||||
| Microsoft | Windows Server 2019 | affected |
|
||||||
| Microsoft | Windows Server 2019 (Server Core installation) | affected |
|
||||||
| Microsoft | Windows Server 2022 | affected |
|
||||||
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | affected |
|
||||||
| Microsoft | Windows Server 2025 | affected |
|
||||||
| Microsoft | Windows Server 2025 (Server Core installation) | affected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Server | — |
| Microsoft | Windows | — |
| Microsoft | Windows 2008 | — |
| Microsoft | Windows Server | — |
| Microsoft | Windows Server 2008 Sp2 | — |
| Microsoft | Windows Server 2012 | — |
| Microsoft | Windows Server 2012 R2 | — |
| Microsoft | Windows Server 2016 | — |
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2025-24316 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: 1.3% (1.330% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Microsoft windows Server 2008 R2
Microsoft windows Server 2012 R2 Microsoft windows Server 23h2 |
|
| CPEs | cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_23h2:*:*:*:*:*:*:*:* |
|
| Vendors & Products |
Microsoft windows Server 2008 R2
Microsoft windows Server 2012 R2 Microsoft windows Server 23h2 |
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Microsoft windows Server 2008
Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2022 23h2 Microsoft windows Server 2025 |
|
| CPEs | cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* |
|
| Vendors & Products |
Microsoft windows Server 2008
Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2022 23h2 Microsoft windows Server 2025 |
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Microsoft
Microsoft server Microsoft windows Microsoft windows 2008 Microsoft windows Server Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 Microsoft windows Server 2012 R2 Microsoft windows Server 2016 |
|
| Vendors & Products |
Microsoft
Microsoft server Microsoft windows Microsoft windows 2008 Microsoft windows Server Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 Microsoft windows Server 2012 R2 Microsoft windows Server 2016 |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. | |
| Title | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | |
| Weaknesses | CWE-908 | |
| References |
| |
| Metrics |
cvssV3_1
|