CVE-2024-43454: RCE in Windows Remote Desktop Licensing Service

Successful exploitation of CVE-2024-43454 could allow an attacker to gain complete control over the affected system. This could involve executing malicious code, installing malware, stealing sensitive data, or establishing a persistent presence on the network. Given the role of the Remote Desktop Licensing Service in managing access to remote desktop connections, a compromised service could be leveraged to gain unauthorized access to numerous systems. The potential blast radius is significant, particularly in environments heavily reliant on Remote Desktop Services for administration or user access.

1. Reserved2024-08-14
2. Published2024-09-10
3. Modified2024-12-31
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-43454 is to upgrade to the fixed version, 10.0.25398.1128, as soon as possible. If immediate patching is not feasible, consider implementing network segmentation to limit the potential impact of a successful attack. Monitor network traffic for suspicious connections to the Remote Desktop Licensing Service. While a direct WAF rule is unlikely, restricting access to the licensing service's ports (typically TCP 3389) from untrusted networks can reduce the attack surface. After upgrade, confirm by verifying the service version using Get-Service -Name RemoteDesktopLicensing | Select-Object DisplayName, Status, StartType, ServiceType, PathName in PowerShell.