CVE-2017-11885

MEDIUM

Microsoft Windows RRAS Service - Remote Code Execution

Title source: manual
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-11885. PoCs published by vportal.

AI-analyzed exploit summary This exploit targets CVE-2017-11885, an arbitrary pointer dereference vulnerability in the RRAS service on Windows Server 2003. It leverages a crafted MIB_OPAQUE_QUERY structure to achieve remote code execution via a bind shell payload.

Description

Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow a remote code execution vulnerability due to the way the Routing and Remote Access service handles requests, aka "Windows RRAS Service Remote Code Execution Vulnerability".

Exploits (1)

exploitdb WORKING POC VERIFIED
by vportal · pythonremotewindows
https://www.exploit-db.com/exploits/44616

This exploit targets CVE-2017-11885, an arbitrary pointer dereference vulnerability in the RRAS service on Windows Server 2003. It leverages a crafted MIB_OPAQUE_QUERY structure to achieve remote code execution via a bind shell payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Windows Server 2003 SP2 (with RRAS service enabled)
No auth needed
Prerequisites: RRAS service enabled on target · Network access to target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102055
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039987
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44616/

Scores

CVSS v3 6.6
EPSS 0.4552
EPSS Percentile 98.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (15)
microsoft/windows_10
microsoft/windows_10 1511
microsoft/windows_10 1607
microsoft/windows_10 1703
microsoft/windows_10 1709
microsoft/windows_7
microsoft/windows_8.1
microsoft/windows_rt_8.1
microsoft/windows_server_2008
microsoft/windows_server_2008 r2 sp1 (2 CPE variants)
... and 5 more
Published Dec 12, 2017
Tracked Since Feb 18, 2026