CVE-2022-24883 - CVE House
Back to Database
Status published High CVE-2022-24883

FreeRDP Server authentication might allow invalid credentials to pass

Vulnerability Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authentication against a `SAM` file might be successful for invalid credentials if the server has configured an invalid `SAM` file path. FreeRDP based clients are not affected. RDP server implementations using FreeRDP to authenticate against a `SAM` file are affected. Version 2.7.0 contains a fix for this issue. As a workaround, use custom authentication via `HashCallback` and/or ensure the `SAM` database path configured is valid and the application has file handles left.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24883

Credits & Attribution

No credits recorded in the NVD database.

References

More from FreeRDP

View All →
CVE-2025-68118
Potential Heap Out-of-Bounds Read in freerdp_certificate_data_hash_ via Unsafe _snprintf Usage
Medium 6.6
CVE-2024-32662
FreeRDP rdp_redirection_read_base64_wchar out of bound read
High 7.5
CVE-2024-32661
FreeRDP rdp_write_logon_info_v1 NULL access
High 7.5
CVE-2024-32660
FreeRDP zgfx_decompress out of memory vulnerability
High 7.5
CVE-2024-32659
freerdp_image_copy out of bound read
Critical 9.8

Affected Vendor

Affected Software

FreeRDP
Vulnerable Versions:
< 2.7.0

Timeline

Official Publish: April 26th, 2022
Last Modified: November 3rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access