VULNERABILITY INTELLIGENCE
CVE-2022-24882
CVSS score9.1 CRITICAL
EPSS probability2.85%
CISA KEVNot currently listed
Published2022-04-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
Weakness classification
- security-advisories@github.com: CWE-287
- nvd@nist.gov: NVD-CWE-Other
Primary references
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com — Release Notes, Third Party Advisory
- security-advisories@github.com — Third Party Advisory
- security-advisories@github.com — Exploit, Issue Tracking, Third Party Advisory
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com
- security-advisories@github.com — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory