CVE-2006-2370: Microsoft Windows RRAS RPC buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with a high EPSS score, though limited to legacy Windows versions and with no KEV listing or documented exploit in the record.

What it is

The Routing and Remote Access service (RRAS) in Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1 and earlier contains a buffer overflow reachable through crafted RPC-related requests. Successful exploitation allows arbitrary code execution on the affected host. The flaw is remotely reachable and does not require authentication, making it a serious pre-auth risk on systems running RRAS.

Impact

An attacker can execute arbitrary code with the privileges of the RRAS service, typically SYSTEM, leading to full host compromise. No user interaction is required.

Attack surface

Reached over the network via RPC requests to the RRAS service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is needed. The description notes both unauthenticated and authenticated attackers can trigger it.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.70144, 99.3rd percentile), and multiple references carry Patch tags, but no public exploit reference is present in the record.

What to do

• Apply Microsoft security bulletin MS06-025 (the vendor patch referenced in the record) to all affected Windows 2000, XP, and Server 2003 systems.
• If RRAS is not required, disable the Routing and Remote Access service and stop it from starting automatically.
• Restrict RPC traffic to RRAS-related ports using host and network firewalls, allowing only trusted management hosts.
• Isolate or upgrade end-of-life platforms (Windows 2000, XP, Server 2003) that cannot receive current patches.
• Monitor for unexpected RRAS service crashes or restarts, which may indicate exploitation attempts.

Detection

• Monitor Windows event logs for RRAS service crashes, unexpected restarts, or service failures.
• Inspect network traffic for anomalous RPC requests targeting the RRAS service on affected hosts.
• Use host-based detection to flag unexpected child processes or code execution originating from the RRAS service (svchost.exe hosting RRAS).
• Audit systems still running Windows 2000 SP4, XP SP1/SP2, or Server 2003 SP1 and earlier with RRAS enabled.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.