Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

According to the CVSS metric, the attack vector is network (AV:N), user interaction is required (UI:R), and privileges required are none (PR:N). What does that mean for this vulnerability?
Exploitation of this vulnerability requires an unauthorized attacker to wait for a user to initiate a connection to a malicious server that the attacker has set up prior to the user connecting.

How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by tricking a user into sending a request to a malicious server. This could result in the server returning malicious data that might cause arbitrary code execution on the user's system.

Security updates
10.0.17763.8146 — https://support.microsoft.com/help/5071544
10.0.20348.4529 — https://support.microsoft.com/help/5071547
10.0.20348.4467 — https://support.microsoft.com/help/5071413
10.0.19044.6691 — https://support.microsoft.com/help/5071546
10.0.26100.7462 — https://support.microsoft.com/help/5072033
10.0.26100.7392 — https://support.microsoft.com/help/5072014
10.0.22631.6345 — https://support.microsoft.com/help/5071417
10.0.25398.2025 — https://support.microsoft.com/help/5071542
10.0.14393.8688 — https://support.microsoft.com/help/5071543
6.0.6003.23666 — https://support.microsoft.com/help/5071504
6.0.6003.23666 — https://support.microsoft.com/help/5071507
6.1.7601.28064 — https://support.microsoft.com/help/5071501
6.1.7601.28064 — https://support.microsoft.com/help/5071506
6.2.9200.25815 — https://support.microsoft.com/help/5071505
6.3.9600.22920 — https://support.microsoft.com/help/5071503