CVE-2024-38077

What it actually does

This is a network-exploitable remote code execution vulnerability in the Windows Remote Desktop Licensing Service. A vulnerable licensing service can be reached remotely without authentication or user interaction, and successful exploitation can allow attacker-controlled code to run with the privileges of the affected service, potentially leading to full system compromise. The CVSS vector indicates low attack complexity, no required privileges, no user interaction, and high confidentiality, integrity, and availability impact. The supplied affected-product metadata lists Debian 13 Linux fixed in version 6.6.8-1, which does not align with the Windows Remote Desktop Licensing Service description; vulnerability management teams should verify product mapping in their source inventory while prioritizing Windows systems running the Remote Desktop Licensing role.

Why it matters to the business

Compromise of a Remote Desktop Licensing server can give an attacker a foothold inside infrastructure that commonly supports remote access operations. Consequences may include unauthorized administrative access, credential theft, lateral movement, service disruption for remote desktop users, deployment of malware, and broader domain or server compromise. Although this vulnerability is not listed in CISA KEV and the provided exploit maturity is None, the 9.8 severity and high EPSS score indicate meaningful exploitation risk, especially for exposed or broadly reachable licensing services that have remained unpatched since publication.

How an attack unfolds

An attacker first identifies systems exposing Remote Desktop Licensing-related network services, typically through external scanning, internal reconnaissance, or discovery after initial access. The attacker then sends crafted network traffic to the vulnerable service to trigger the flaw. If exploitation succeeds, code executes on the target under the service context. From there, the attacker may establish persistence, run discovery commands, dump credentials, disable defenses, pivot to adjacent systems, or disrupt Remote Desktop licensing availability. Because the vulnerability requires no authentication and no user interaction, internet-exposed or widely reachable licensing servers are the highest-risk targets.

How to fix it

Apply the vendor security update that fixes CVE-2024-38077 to all Windows systems running the Remote Desktop Licensing Service or Remote Desktop Licensing role. If immediate patching is not possible, disable the Remote Desktop Licensing Service where it is not required, restrict inbound access to the service using host and network firewalls, block unnecessary exposure from the internet, and limit access to trusted management or RDS infrastructure segments only. Monitor for abnormal service behavior until patching is complete. The provided package data also states Debian 13 Linux is fixed in version 6.6.8-1; because that product mapping conflicts with the Windows-specific vulnerability description, validate scanner findings and upgrade any genuinely affected Debian packages to 6.6.8-1 or later only if confirmed by the authoritative advisory source.

How to confirm the fix worked

Confirm that all Windows hosts with the Remote Desktop Licensing role have the applicable Microsoft security update installed. Validate that the Remote Desktop Licensing Service is disabled on systems where it is not required. From a network perspective, verify that Remote Desktop Licensing/RPC access is not exposed to untrusted networks and that firewall rules restrict access to approved sources. Use vulnerability scanners after patching to confirm the finding is no longer reported, but reconcile any scanner result that maps this Windows RDS vulnerability to Debian Linux because the supplied metadata appears inconsistent. For Debian findings, verify installed package versions and confirm they are at least 6.6.8-1 where the advisory source confirms applicability.

Typical attack path

1. Identify Windows servers running the Remote Desktop Licensing Service or Remote Desktop Services Licensing role.
2. Confirm that the service is reachable over the network, including RPC/RDS-related ports and dynamic RPC endpoints where applicable.
3. Send crafted unauthenticated traffic to the vulnerable licensing service to trigger remote code execution.
4. Gain command execution in the service context on the target host.
5. Deploy a payload, create persistence, or execute post-exploitation tooling.
6. Perform credential access and internal reconnaissance.
7. Move laterally to other servers or domain assets.
8. Use the compromised host to exfiltrate data, disrupt operations, or stage additional attacks.

How to detect it

To determine whether exploitation has already occurred, review Windows hosts running the Remote Desktop Licensing Service for abnormal inbound network activity, service instability, and post-exploitation behavior. Relevant sources include Windows System logs, Security logs, Application logs, Microsoft-Windows-TerminalServices-Licensing logs, Windows Defender or EDR telemetry, PowerShell logs, Sysmon logs, firewall logs, and NetFlow. Look for unexpected inbound RPC/RDS licensing connections from untrusted IPs, crashes involving svchost.exe or Remote Desktop Licensing components, unusual child processes spawned by svchost.exe hosting TermServLicensing, suspicious command execution, new services, scheduled tasks, credential dumping activity, and lateral movement after contact with the licensing service. Pay special attention to Security Event ID 4624 network logons, 4688 process creation, 7045 new service installation, PowerShell 4104 script block logging, Sysmon Event IDs 1, 3, 7, 10, and 11, and Windows Error Reporting entries referencing the licensing service or related DLLs. Because no public exploit-specific artifact is provided in the input, detection should focus on service-level anomalies and generic post-exploitation indicators rather than a single definitive payload signature.

• TermServLicensing
• Remote Desktop Licensing
• Microsoft-Windows-TerminalServices-Licensing/Operational
• svchost.exe -k termsvcs
• lserver.dll
• System Event ID 7036
• System Event ID 7045
• Security Event ID 4624
• Security Event ID 4688
• PowerShell Event ID 4104
• Sysmon Event ID 1
• Sysmon Event ID 3
• Sysmon Event ID 7
• Sysmon Event ID 10
• Sysmon Event ID 11
• Application Error
• Windows Error Reporting
• TCP/135
• TCP/3389
• RPC dynamic ports 49152-65535

What your security team should do

• Prioritize patching or isolating Windows servers running the Remote Desktop Licensing Service due to unauthenticated remote code execution risk and high EPSS probability.
• Perform an inventory search for systems with the Remote Desktop Licensing role or TermServLicensing service installed or running.
• Remove internet exposure and restrict RPC/RDS licensing access to trusted internal sources only.
• Disable the Remote Desktop Licensing Service on systems that do not need it.
• Review logs for prior suspicious access, service crashes, unexpected child processes, and post-exploitation activity from licensing servers.
• Validate vulnerability scanner mappings, because the supplied affected-product data lists Debian Linux while the vulnerability description refers to Windows Remote Desktop Licensing.
• Increase monitoring for svchost-hosted service anomalies, credential access, lateral movement, and new persistence mechanisms on affected servers.
• If Debian 13 Linux package findings are confirmed by a trusted advisory source, upgrade affected packages to 6.6.8-1 or later.