CVE-2019-1222

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP. The update addresses the vulnerability by correcting how Remote Desktop Services handles connection requests.

• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190819-01-windows-enThird Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-187667.pdf
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1222Patch, Vendor Advisory
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190819-01-windows-enThird Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-187667.pdf
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1222Patch, Vendor Advisory

Published

Aug 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12214In FreeImage 3.18.0, an out-of-bounds access occurs because …
• CVE-2019-12215A full path disclosure vulnerability was discovered in Matom…
• CVE-2019-12216An issue was discovered in libSDL2.a in Simple DirectMedia L…6.5
• CVE-2019-12217An issue was discovered in libSDL2.a in Simple DirectMedia L…
• CVE-2019-12218An issue was discovered in libSDL2.a in Simple DirectMedia L…
• CVE-2019-12219An issue was discovered in libSDL2.a in Simple DirectMedia L…
• CVE-2019-12220An issue was discovered in libSDL2.a in Simple DirectMedia L…
• CVE-2019-12221An issue was discovered in libSDL2.a in Simple DirectMedia L…6.5
• CVE-2019-12222An issue was discovered in libSDL2.a in Simple DirectMedia L…
• CVE-2019-12223An issue was discovered in NVR WebViewer on Hanwah Techwin S…
• CVE-2019-1223A denial of service vulnerability exists in Remote Desktop P…7.5
• CVE-2019-12239The WP Booking System plugin 1.5.1 for WordPress has no CSRF…7.2