Information disclosure in Windows Server - CVE-2025-49671
Published: July 8, 2025
Vulnerability identifier: #VU112479
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2025-49671
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Microsoft
Affected software:
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Windows Server
Detailed vulnerability description
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Windows Routing and Remote Access Service (RRAS). A remote attacker can gain unauthorized access to sensitive information on the system.
How to mitigate CVE-2025-49671
Install updates from vendor's website.