Vulnerability record · CVE-2012-0152 · published 13 March 2012
CVE-2012-0152: Windows RDP service hangs on crafted packet sequence
Microsoft · Windows 7
The Remote Desktop Protocol service in Windows 7 and Windows Server 2008 R2 fails to properly validate a series of crafted packets, causing the service to hang. This is a denial-of-service condition affecting the RDP listener itself, so it can interrupt remote administration and remote desktop availability on exposed hosts.
Description
The Remote Desktop Protocol (RDP) service in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (application hang) via a series of crafted packets, aka "Terminal Server Denial of Service Vulnerability."
AV:N/AC:M/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityThe flaw is an unauthenticated remote denial of service with a high EPSS score, but it only causes a hang (partial availability impact) and is not known to be actively exploited or in KEV.
What it is
The Remote Desktop Protocol service in Windows 7 and Windows Server 2008 R2 fails to properly validate a series of crafted packets, causing the service to hang. This is a denial-of-service condition affecting the RDP listener itself, so it can interrupt remote administration and remote desktop availability on exposed hosts.
Impact
An unauthenticated remote attacker can hang the RDP service, denying legitimate remote desktop and terminal server access until the service is restarted or the host recovers.
Attack surface
Reachable over the network through the RDP service (TCP 3389) with no authentication required, per the AV:N/Au:N vector. No user interaction is indicated by the description or vector.
Exploitation
Not listed in CISA KEV and no reference tags indicate public exploit code, though the EPSS 30-day probability is high at 0.86262 (99.7th percentile), suggesting elevated predicted exploitation activity.
What to do
- Apply Microsoft security bulletin MS12-020 for the affected Windows 7 and Windows Server 2008 R2 systems.
- Restrict RDP exposure to trusted networks or place it behind a VPN or jump host rather than the public internet.
- Enable Network Level Authentication and limit RDP access to authorized accounts.
- Monitor and rate-limit RDP connection attempts at the perimeter to reduce exposure to crafted packet floods.
- Where RDP is not required, disable the Remote Desktop service on affected hosts.
Detection
- Monitor Windows System and TerminalServices event logs for unexpected RDP service hangs, restarts, or crashes.
- Alert on high-volume or malformed RDP connection patterns to TCP 3389 from single sources.
- Track RDP service availability and restart events on Windows 7 and Server 2008 R2 hosts as a DoS indicator.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-0152 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-0152), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
