Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

An attacker who connects to a Windows machine with RDP enabled could read sensitive memory information from the RDP service, potentially revealing credentials, encryption keys, or other confidential data without authentication. This creates a risk of lateral movement or further compromise.

IT staff and network administrators managing Windows servers and workstations. This particularly affects water utilities and electric utilities that use Windows servers for SCADA historian systems, HMI platforms (like those running on Windows Server 2019/2022), and administrative workstations that may access industrial control systems. Any Windows 10 or Windows Server machine with RDP enabled and connected to a network is potentially affected.

An attacker needs network access to the RDP port (typically 3389) on an affected Windows machine. They send a specially crafted RDP connection request that triggers an uninitialized memory read in the RDP service, allowing them to extract sensitive data from memory without providing valid credentials.