Information disclosure in Windows Server - CVE-2025-49671
Published: July 8, 2025
Vulnerability identifier: #VU112479
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-49671
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Routing and Remote Access Service (RRAS). A remote attacker can gain unauthorized access to sensitive information on the system.
Affected software
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
How to mitigate CVE-2025-49671
Install updates from vendor's website.
Windows Server - addressed in versions 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025