CVE-2022-24882
CRITICALFreeRDP < 2.7.0 - Improper Authentication via Empty Password Handling
Title source: llmDescription
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
References (9)
Core 9
Core References
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AELSWWBAM2YONRPGLWVDY6UNTLJERJYL/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOYKBQOHSRM7JQYUIYUWFOXI2JZ2J5RD/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZWR6KSIKXO4B2TXBB3WH6YTNYHN46OY/
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202210-24
Patch, Third Party Advisory
https://github.com/FreeRDP/FreeRDP/pull/7750
Release Notes, Third Party Advisory
https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0
Third Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6x5p-gp49-3jhh
Exploit, Issue Tracking, Third Party Advisory
https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/95
Scores
CVSS v3
9.1
EPSS
0.0069
EPSS Percentile
72.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-287
Status
published
Products (5)
fedoraproject/extra_packages_for_enterprise_linux
8.0
fedoraproject/fedora
34
fedoraproject/fedora
35
fedoraproject/fedora
36
freerdp/freerdp
< 2.7.0
Published
Apr 26, 2022
Tracked Since
Feb 18, 2026