CVE-2019-1182

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP. The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.

• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190819-01-windows-enThird Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-187667.pdf
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1182Patch, Vendor Advisory
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190819-01-windows-enThird Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-187667.pdf
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1182Patch, Vendor Advisory

Published

Aug 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11813An issue was discovered in app/View/Elements/Events/View/val…
• CVE-2019-11814An issue was discovered in app/webroot/js/misp.js in MISP be…
• CVE-2019-11815An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.…8.1
• CVE-2019-11816Incorrect access control in the WebUI in OPNsense before ver…7.2
• CVE-2019-11818Alkacon OpenCMS v10.5.4 and before is affected by stored cro…
• CVE-2019-11819Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka E…
• CVE-2019-11820Information exposure through process environment vulnerabili…5.5
• CVE-2019-11821SQL injection vulnerability in synophoto_csPhotoDB.php in Sy…9.8
• CVE-2019-11822Relative path traversal vulnerability in SYNO.PhotoStation.F…6.5
• CVE-2019-11823CRLF injection vulnerability in Network Center in Synology R…7.5
• CVE-2019-11824Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-11825Cross-site scripting (XSS) vulnerability in Event Editor in …5.4