Infinite Login Attempts Vulnerability in xrdp RDP Server

CVE-2024-39917

What is CVE-2024-39917?

xrdp, an open-source Remote Desktop Protocol (RDP) server developed by Neutrinolabs, has a security vulnerability that permits attackers to execute an unlimited number of login attempts. This flaw arises from a malfunction in the MaxLoginRetry setting, intended to restrict the number of login attempts to enhance security. As the configuration parameter located in /etc/xrdp/sesman.ini fails to operate effectively, it exposes users to potential brute-force attacks, leaving the remote desktop services vulnerable to unauthorized access. Proper configuration and scrutiny of the affected versions are crucial for safeguarding against this vulnerability.

References