CVE-2022-24882 Server side NTLM does not properly check parameters in FreeRDP

Critical 9.1 Published 26 Apr 2022 Updated 3 Nov 2025

FreeRDP server implementations allow authentication bypass when an empty password is provided during NTLM authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-24882?

CVE-2022-24882 is a critical authentication bypass vulnerability in Fedoraproject Extra Packages for Enterprise Linux, published on 26 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.

Weakness: CWE-287

Which versions are affected by CVE-2022-24882?

It affects 3 products.

Products include Fedoraproject Extra Packages for Enterprise Linux, Fedoraproject Fedora, Freerdp Freerdp.

How do I fix CVE-2022-24882?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-24882 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24882 exists.

All Fedoraproject Extra Packages for Enterprise Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-24882, GHSA-6x5p-gp49-3jhh, UBUNTU-CVE-2022-24882.