CVE-2022-24882
Server side NTLM does not properly check parameters in FreeRDP
- State
- Published
- Severity
- 9.1 Critical
- Published
- Apr 26, 2022
- Updated
- Nov 3, 2025
- Reserved
- Feb 10, 2022
Description
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | GitHub_M |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
FreeRDPFreeRDP |
|
References
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6x5p-gp49-3jhh
- https://github.com/FreeRDP/FreeRDP/pull/7750
- https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/95
- FEDORA-2022-dc48a89918vendor-advisory
- FEDORA-2022-a3e03a200bvendor-advisory
- FEDORA-2022-b0a47f8060vendor-advisory
- GLSA-202210-24vendor-advisory
- https://lists.debian.org/debian-lts-announce/2025/02/msg00034.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.