FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.
CVSS Details
- CVSS 4.0 Base Score: 8.3 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade freerdp-libsUpgrade libwinprUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-serverUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade freerdp-server-debuginfoUpgrade freerdpUpgrade freerdp-debugsource | Sep 1, 2026 | Aug 11, 2026 |
| Redhat_linux | — | Upgrade freerdp-serverUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-server-debuginfoUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debugsource | Sep 2, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade freerdp-server-debuginfoUpgrade libwinprUpgrade freerdp-serverUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-debuginfo | Sep 3, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub