Stealthy Exploit Targets Windows Deployment Services: No Clicks, No Credentials, Full Disruption
A critical weakness has surfaced in Microsoft’s Windows Deployment Services (WDS), revealing that enterprise networks can be remotely disrupted without any user interaction or authentication. This zero-click vulnerability exploits the way WDS handles network requests over UDP, specifically its TFTP service running on port 69.
At the heart of the issue is an architectural oversight: WDS does not impose a cap on active session tracking. Each incoming TFTP request, even from spoofed or non-existent clients, triggers the creation of a new session. The service, relying on EndpointSessionMapEntry, accepts these requests indiscriminately, allowing attackers to flood the system until available memory is consumed and the server crashes.
Security researcher Zhiniang Peng, who discovered the flaw, details how attackers can craft fake IP addresses and ports to simulate a flood of clients—overwhelming the CTftpSession instantiation mechanism. The WDS component responsible for managing these sessions, wdstftp!CClientContext::OnConnectionRequest, is particularly susceptible to this form of abuse.
What makes this exploit especially dangerous is its accessibility: no sophisticated tooling, no high-level privileges, and no legitimate credentials are required. With a few simple scripts, even novice threat actors could cripple large-scale OS deployment services in moments.
Organizations relying on WDS should act quickly to evaluate their exposure, consider isolating or disabling the TFTP service, and monitor network traffic for anomalous patterns indicative of spoofed UDP floods.
WDS Under Siege: UDP Flaw Enables Effortless Server Exhaustion
Attackers have a new, deceptively simple weapon against Windows Deployment Services (WDS)—and all it takes is spoofed UDP traffic. Due to the connectionless nature of the UDP protocol, WDS fails to verify the origin of incoming TFTP packets. This flaw opens the door to a denial-of-service (DoS) attack that rapidly depletes system memory by triggering unlimited session allocations.
Demonstration of a Silent Crash
In a controlled test, researcher Zhiniang Peng simulated the attack on a Windows Server Insider Preview system equipped with 8GB of RAM. Using a basic script to flood port 69 with fake UDP packets, memory usage skyrocketed to 15GB in under seven minutes—ultimately crashing the machine.
What makes this threat especially unnerving is its low barrier to execution. No advanced tools or exploit kits are needed—just a Linux box and a simple multithreaded script. Despite its minimal complexity, the attack is devastating in scope, capable of taking down network-wide PXE services with zero authentication or interaction.
A Critical Hit to Enterprise Infrastructure
Windows Deployment Services is deeply integrated into enterprise IT environments—from Fortune 500 data centers to university labs. The inability of WDS to defend against spoofed session floods leaves organizations vulnerable to complete OS deployment paralysis. With no native limit on session creation, a handful of forged requests can overwhelm server resources within minutes.
Although Microsoft has opted not to patch the issue, Peng emphasizes the severity: “It’s still a critical DoS vector capable of remotely disabling an entire PXE environment.”
No Patch, Few Options
The vulnerability remains unaddressed by Microsoft, leaving defenders with limited choices. Alternatives include transitioning away from WDS altogether or locking down network access to the vulnerable TFTP service. Filtering external traffic targeting port 69 may offer some protection, but it’s far from a guaranteed fix.
This isn’t the first time WDS has come under scrutiny. It previously suffered a remote code execution vulnerability (CVE-2019-0603), which was resolved in 2019. However, this latest issue underscores a lingering design weakness—one that adversaries can now easily exploit.
