CVE-2019-0708
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Nov 3, 2021
- US federal agencies must remediate it by May 3, 2022 (BOD 22-01)
- First attack observed 76 days after disclosure
- Confirmed by sensors, not only by reports
- Used in ransomware campaigns
Apply updates per vendor instructions.
Source: CISA KEV · Oct 13, 2026 Sep 16, 2026 Jan 20, 2026 Nov 18, 2025 Aug 25, 2025 Jun 26, 2025
CVSS score9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-416, CWE-416
Vendorssiemens, microsoft
Affected products
| Vendors | Product | Versions |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows server 2008 | - |
| siemens | axiom multix m firmware | — |
| siemens | axiom multix m | - |
| siemens | axiom vertix md trauma firmware | — |
| siemens | axiom vertix md trauma | - |
| siemens | axiom vertix solitaire m firmware | — |
| siemens | axiom vertix solitaire m | - |
| siemens | mobilett xp digital firmware | — |
| siemens | mobilett xp digital | - |
| siemens | multix pro acss p firmware | — |
| siemens | multix pro acss p | - |
| siemens | multix pro p firmware | — |
| siemens | multix pro p | - |
| siemens | multix pro firmware | — |
| siemens | multix pro | - |
| siemens | multix pro acss firmware | — |
| siemens | multix pro acss | - |
| siemens | multix pro navy firmware | — |
| siemens | multix pro navy | - |
| siemens | multix swing firmware | — |
| siemens | multix swing | - |
| siemens | multix top firmware | — |
| siemens | multix top | - |
| siemens | multix top acss firmware | — |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.