Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?
This attack requires an admin user on the client to connect to a malicious server, and that could allow the attacker to gain code execution on the client.

How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by tricking a user into sending a request to a malicious server. This could result in the server returning malicious data that might cause arbitrary code execution on the user's system.

Security updates
10.0.17763.6189 — https://support.microsoft.com/help/5041578
10.0.20348.2655 — https://support.microsoft.com/help/5041160
10.0.25398.1085 — https://support.microsoft.com/help/5041573
10.0.14393.7259 — https://support.microsoft.com/help/5041773
6.0.6003.22825 — https://support.microsoft.com/help/5041850
6.0.6003.22825 — https://support.microsoft.com/help/5041847
6.1.7601.27277 — https://support.microsoft.com/help/5041838
6.1.7601.27277 — https://support.microsoft.com/help/5041823
6.2.9200.25031 — https://support.microsoft.com/help/5041851
6.3.9600.22134 — https://support.microsoft.com/help/5041828