Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.

Improper access control / external control of path (CWE-73) in the Windows Deployment Services image-server provider WdsImgSrv.dll, adjacent-network info disclosure -> RCE. WDS transmits the unattend.xml answer file (containing admin password, domain-join creds) to clients over an UNAUTHENTICATED RPC channel. Pre-patch, HandlerClientUnattend looked up and transmitted the unattended-install file on a client request with no policy/authentication check, so an attacker with LAN access could MITM the client<->server path or impersonate a client and read the plaintext deployment secrets. Diff of WdsImgSrv.dll 10.0.14393.8781 -> .8864 (brackets the .8783 KB5073722 fix) confirms the patch: a new registry policy check (EvaluateCurrentStateFromRegistry / EvaluateCurrentState / EvaluateFeature, added RegOpenKeyExW(HKLM)+RegQueryValueExW) wired into WdsProviderInitialize and HandlerClientUnattend reads HKLM\System\CurrentControlSet\Services\WdsServer\Providers\WdsImgSrv\Unattend\AllowHandsFreeFunctionality before serving the file. If the admin explicitly allows the insecure setting it proceeds but logs a warning ('...may expose sensitive configuration files to interception...', fwlink 2344403); otherwise the request is rejected. Microsoft will enable the protection by default after a mid-2026 update, phasing out unauthenticated hands-free deployment.

WDS serves the unattend answer file over unauthenticated RPC, so a LAN attacker MITMs or impersonates a client to read plaintext deployment secrets

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Microsoft Offensive Research and Security Engineering (MORSE) with Microsoft