A newly discovered vulnerability in Microsoft’s Windows Deployment Services (WDS) allows attackers to remotely crash servers with zero user interaction or authentication. The flaw, which requires no authentication or user interaction (0-click), allows attackers to remotely exhaust system memory by exploiting a design weakness in how WDS handles UDP-based TFTP sessions on port 69. This vulnerability poses a significant threat to organizations that rely on WDS for network-based OS deployment, as it allows attackers to completely disrupt PXE boot services across an enterprise without requiring any authentication or privileged access. In a test environment running Windows Server Insider Preview with 8GB of RAM, Peng demonstrated that by continuously sending spoofed UDP packets to port 69, memory consumption rapidly increased to 15GB within just 7 minutes, causing the entire system to crash. At present, there appears to be no effective mitigation strategy for organizations using Windows Deployment Services other than considering alternative deployment solutions or implementing strict network filtering to limit access to port 69. Consequently, an attacker can forge fake client IP addresses and port numbers, repeatedly creating new sessions until system resources are exhausted,” Security researcher Zhiniang Peng explains in his published analysis. Windows Deployment Services is widely used in corporate networks, data centers, and educational institutions for streamlined OS deployments, making this vulnerability particularly concerning for IT administrators. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Since UDP servers cannot verify packet sources, attackers can spoof packets with randomized source addresses and ports, forcing the server to allocate excessive session objects in memory without limitation. Notably, the attack leverages unauthenticated, spoofed network traffic, making it both stealthy and difficult to defend against with traditional security controls. Kaaviya is a Security Editor and fellow reporter with Cyber Security News.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 06 May 2025 07:15:06 +0000