漏洞描述 【漏洞对象】Windows操作系统【漏洞描述】当未经身份验证的攻击者使用RDP连接到目标系统并发送经特殊设计的请求时,远程桌面服务(以前称为“终端服务”)中存在远程执行代码漏洞。此漏洞是预身份验证,无需用户交互。成功利用此漏洞的攻击者可以在目标系统上执行任意代码。攻击者可随后安装程序;查看、更改或删除数据;或者创建拥有完全用户权限的新帐户。
相关漏洞推荐 Windows PolicyConfiguration 计划任务特权提升漏洞(CVE-2025-60710) Windows 11 PolicyConfiguration 计划任务特权提升漏洞(CVE-2025-60710) Windows NTLMv2-SSP Hash信息泄露漏洞(CVE-2025-50154) POC CVE-2015-1635: Microsoft Windows 'HTTP.sys' - Remote Code Execution POC CVE-2017-7269: Windows Server 2003 & IIS 6.0 - Remote Code Execution POC CVE-2024-38472: Apache HTTPd Windows UNC - Server-Side Request Forgery POC generic-windows-lfi: Generic Windows based LFI Test POC automatic-windows-updates-disabled: Automatic Windows Updates Disabled POC sticky-keys-enabled-login: Sticky Keys Enabled at Login Screen POC windows-active-desktop-enabled: Active Desktop Enabled POC windows-administrative-shares-enabled: Administrative Shares Enabled POC windows-administrator-blank-password: Built-in Administrator Account Has Blank Password POC windows-anonymous-sid-enumeration-allowed: Windows Allows Anonymous SID Enumeration