radzarr/wsusresponderModule PowerShell de réponse à l'incident CVE-2025-59287 — WSUS Remote Code Execution (RCE)
Version: 1.0.1
Author: RZA / IT Operations
License: MIT
The WSUSResponder module provides a set of PowerShell tools to quickly respond to the critical vulnerability CVE-2025-59287, a remote code execution (RCE) flaw affecting Windows Server Update Services (WSUS).
It allows you to:
| Module | Role | Installation |
|---|
| ActiveDirectory | Automatic server discovery via AD | Add-WindowsCapability -Online -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0' |
| ImportExcel | Excel report generation (.xlsx) | Install-Module ImportExcel -Scope CurrentUser |
Enable-PSRemoting)WSUSResponder in one of your PowerShell module directories:
$Path = "$env:USERPROFILE\Documents\WindowsPowerShell\Modules\WSUSResponder"
New-Item -ItemType Directory -Path $Path -Force
WSUSResponder.psm1WSUSResponder.psd1Import-Module WSUSResponder
Get-Command -Module WSUSResponder
Get-Module WSUSResponder -ListAvailable
| Function | Description |
|---|---|
| Get-WSUSCveStatus | Scans servers to detect the presence of the WSUS role and OOB patches. |
| Set-WSUSCveWorkaround | Applies the workaround (firewall rules blocking ports 8530/8531). |
| Remove-WSUSCveWorkaround | Removes the firewall rules created by the workaround. |
| Export-WSUSCveReport | Exports scan results in multiple formats (CSV, JSON, XLSX, TXT). |
$ReportPath = "C:\Temp\WSUS_Audit_$(Get-Date -Format yyyyMMdd)"
Get-WSUSCveStatus -FromAD -UsePS7Parallel | Export-WSUSCveReport -ExportPath $ReportPath
$scanResults = Get-WSUSCveStatus -FromAD -UsePS7Parallel
$vulnerable = $scanResults | Where-Object { $_.IsWSUS -and -not $_.IsPatched -and $_.Reachable }
$vulnerable | Set-WSUSCveWorkaround -PassThru
$scanResults | Export-WSUSCveReport -ExportPath "C:\Temp\WSUS_Mitig_$(Get-Date -Format yyyyMMdd)"
Remove-WSUSCveWorkaround -ComputerName 'srv-wsus-01','srv-wsus-02'
Reports are saved in the folder defined by -ExportPath:
| File | Format | Content |
|---|---|---|
| WSUS_CVE59287_Report.csv | CSV | Full scan results |
| WSUS_CVE59287_Report.json | JSON | Structured export for API/automation |
| WSUS_CVE59287_Report.xlsx | XLSX | Formatted report with automatic filters |
| Vulnerable_Hosts.txt | TXT | Simple list of vulnerable hosts |
Invoke-Command and WinRM for remote executionForEach-Object -Parallel) to speed up pre-tests-OperationTimeoutSecIf your execution policy is AllSigned, you can sign the module:
New-SelfSignedCertificate -Type CodeSigning -Subject "CN=IT Operations" -CertStoreLocation Cert:\CurrentUser\My
$cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
Set-AuthenticodeSignature -FilePath "C:\Modules\WSUSResponder\WSUSResponder.psm1" -Certificate $cert
Set-AuthenticodeSignature -FilePath "C:\Modules\WSUSResponder\WSUSResponder.psd1" -Certificate $cert
-UsePS7Parallel)Distributed under the MIT license.
© 2025 RZA / IT Operations – All rights reserved.