X
NEXT
Forgot password?

DigitalXRAID

RDP Gateway Remote Code Execution Vulnerabilities

Threat Intelligence from DigitalXRAID’s Security Operations Centre analysts:

Remote Desktop Gateway (RDG), provides routing for Remote Desktop (RDP). Users firstly connect to the gateway for authentication. Once authentication is successful, the gateway then forwards the RDP traffic to the address specified by the user. Therefore, only the gateway will be exposed to the internet, minimising the chance of the RDP servers being targeted for attack.

In the January 2020 security update, Microsoft addressed two vulnerabilities in remote desktop gateway (RDG). Both bugs, CVE-2020-0609 and CVE-2020-0610, allow for pre-authentication remote code execution.

The vulnerability affects Remote Desktop Gateway on Windows Server (2012, 2012 R2, 2016, and 2019) devices.

These vulnerabilities can be exploited by attackers without any user interaction [and] if successful an attacker can execute arbitrary code on the target system.

Mitigations

It is essential that you apply the latest Windows security updates to the applicable devices, you can navigate to https://support.microsoft.com/en-gb/help/4027667/windows-10-update to find out more. If, for whatever reason you are unable to install this patch, there is still a method to prevent the exploitation of these vulnerabilities. RDG supports three protocols: HTTP, HTTPS, and UDP. The vulnerabilities mentioned only exist in the code responsible for handling UDP protocols. By disabling UDP Transport or firewalling the UDP port (usually port 3391) it is possible to protect your devices from these vulnerabilities.

Previous Article

Threat Intelligence: Telnet Credentials Stolen in IoT Device Hack

Next Article

Threat Intelligence: Emotet spotted spreading via brute-forced Wi-Fi Networks

Cyber Security Experts

Accredited and regulated, we're in the top 1% of cyber security agencies globally

Crown Commercial Service Supplier Cyber Essentials Plus ISO 27001 BSI ISO 9001 CHECK NCSC Cyber Incident Response CREST

We’re trusted by the UK Government as Crown Commercial Service providers as well as being accredited by two of the leading cyber security governing bodies. Our ISO9001 certification means you can rest assured our processes and approach are market leading.

Protect Your Business & Your Reputation.

With a continued focus on security, you can rest assured that breaches and exploits won't be holding you back.

Speak To An Expert

x

Get In Touch

[contact-form-7 id="5" title="Contact Us Form"]