CVE-2022-24882

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.7.0

Description The issue is related to the implementation of the NTLM protocol in the FreeRDP RDP client, which is associated with shortcomings in the authentication procedure. This can allow a remote attacker to disclose protected information when an empty password value is provided. The vulnerability affects FreeRDP-based RDP Server implementations, but RDP clients are not affected.

Recommendations For versions prior to 2.7.0, update to FreeRDP 2.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the NTLM authentication mechanism until a patch is available.