CVE-2022-24882 in FreeRDP
Summary
by MITRE • 04/26/2022
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/05/2026
The vulnerability identified as CVE-2022-24882 resides within FreeRDP, an open-source implementation of Microsoft's Remote Desktop Protocol that enables remote desktop connections across various platforms. This security flaw specifically impacts NT LAN Manager authentication mechanisms within FreeRDP server implementations, creating a potential authentication bypass scenario that could allow unauthorized access to systems. The vulnerability affects all versions prior to 2.7.0 and represents a critical weakness in the authentication flow that could be exploited by malicious actors to gain unauthorized system access.
The technical root cause of this vulnerability stems from improper handling of empty password values during NTLM authentication processes. When an authentication request contains an empty password field, the system should properly terminate the authentication sequence and reject the connection attempt. However, in affected versions, FreeRDP fails to correctly abort the authentication process when presented with empty credentials, potentially allowing attackers to bypass authentication requirements. This flaw manifests specifically in the server-side implementation where the RDP server processes authentication requests, creating a scenario where legitimate authentication mechanisms become ineffective against empty credential submissions.
The operational impact of CVE-2022-24882 extends beyond simple authentication bypasses, as it fundamentally undermines the security posture of any system running vulnerable FreeRDP server implementations. Attackers could exploit this weakness to establish unauthorized remote desktop sessions, potentially gaining access to sensitive corporate networks, administrative systems, or confidential data repositories. The vulnerability is particularly concerning because it affects RDP server implementations that rely on FreeRDP, which are commonly deployed in enterprise environments for remote access solutions, making this a significant risk for organizations that depend on remote desktop services. The absence of known workarounds forces organizations to upgrade their FreeRDP implementations immediately to mitigate this risk.
Organizations should prioritize updating their FreeRDP installations to version 2.7.0 or later to address this vulnerability, as the patch resolves the improper authentication handling that allows empty password values to bypass security controls. This update represents a critical security measure that aligns with industry best practices for maintaining secure remote access infrastructure. The vulnerability maps to CWE-287, which addresses improper authentication issues in software implementations, and could potentially be leveraged by threat actors following ATT&CK techniques related to credential access and remote service exploitation. Security teams should implement comprehensive monitoring for unauthorized authentication attempts and ensure that all remote desktop services are running patched versions to prevent exploitation of this authentication bypass vulnerability.