Vulnerability DatabaseCVE-2024-49105

CVE-2024-49105:
vulnerability analysis and mitigation

Overview

CVE-2024-49105 is a Remote Desktop Client Remote Code Execution Vulnerability affecting Microsoft Windows systems. The vulnerability was initially disclosed on December 11, 2024, and received its initial analysis from NIST on January 8, 2025. The vulnerability affects multiple Microsoft products including Remote Desktop Client, Windows App, and various versions of Windows operating systems including Windows 10, Windows 11, and Windows Server editions (NVD).

Technical details

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.4 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. The vulnerability is classified under CWE-284 (Improper Access Control) according to Microsoft Corporation's assessment (NVD).

Impact

This vulnerability could allow an attacker to execute remote code on affected systems if successfully exploited. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of affected systems (Microsoft Advisory).

Mitigation and workarounds

Microsoft has released security updates to address this vulnerability across multiple affected products and versions. Updates are available for Windows 10 (various versions), Windows 11, and Windows Server editions through their respective KB patches including KB5048652, KB5048685, and others (Rapid7).