CVE-2019-0708

Vendormicrosoft, siemensProductwindows 7, windows server 2008, rapidpoint 500 firmware, aptio firmware, atellica solution firmware, axiom multix m firmware, axiom vertix md trauma firmware, axiom vertix solitaire m firmware, centralink firmware, mobilett xp digital firmware, multix pro acss firmware, multix pro acss p firmware, multix pro firmware, multix pro navy firmware, multix pro p firmware, multix swing firmware, multix top acss firmware, multix top acss p firmware, multix top firmware, multix top p firmware, streamlab firmware, syngo lab process manager, vertix solitaire firmware, viva e firmware, viva twin firmwareDiscoveredMay 16, 2019UpdatedOct 29, 2025

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.

View graph Watch Export

CVSS v3.1

9.8 CRITICAL

EPSS

99.9%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

disclosure → media coverage

May 16, 2019

Disclosure — published as a CVE record. · last revised by NVD Oct 29, 2025

Sep 10, 2025

helpnetsecurity.com reports: Automated network pentesting uncovers what traditional tests missed

Apr 29, 2026

securityweek.com reports: Hundreds of Internet-Facing VNC Servers Expose ICS/OT

Apr 30, 2026

thehackernews.com reports: ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories

Jun 17, 2026

thehackernews.com reports: The Top 10 Attack Surface Exposures in 2026

Sep 16, 2026

securelist.com reports: NightEagle targets Russian companies

Sep 16, 2026

thehackernews.com reports: Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Oct 1, 2026

theregister.com reports: CISO thought he had a 'r3@lg00dp@$$w0rd' but forgot to patch

Public PoC (10)

github.com/hook-s3c/CVE-2019-0708-poc github.com/SherlockSec/CVE-2019-0708 github.com/yetiddbb/CVE-2019-0708-PoC github.com/p0p0p0/CVE-2019-0708-exploit github.com/rockmelodies/CVE-2019-0708-Exploit github.com/anquanscan/CVE-2019-0708 github.com/temp-user-2014/CVE-2019-0708 github.com/areusecure/CVE-2019-0708 github.com/pry0cc/cve-2019-0708-2 github.com/sbkcbig/CVE-2019-0708-EXPloit

Unverified third-party code — review before executing.