Critical Remote Code Execution Flaw in xrdp Threatens Remote Desktop Security
Kaspersky security researchers have uncovered a critical remote code execution (RCE) vulnerability, tracked as CVE-2025-68670, in the xrdp remote desktop server for Linux. The flaw could allow an attacker to execute arbitrary code on vulnerable systems, compromising remote desktop sessions.
Background
xrdp is an open-source implementation of the Remote Desktop Protocol (RDP) commonly used in thin client environments. Kaspersky integrates xrdp into its Kaspersky Thin Client operating system and offers the Kaspersky USB Redirector module to extend USB device access over remote sessions.
Vulnerability Details
The vulnerability resides in the Secure Settings Exchange phase, which occurs before client authentication. During this phase, the client sends protected credentials—including usernames, passwords, and domain names—inside a Client Info PDU (protocol data unit) as TS_INFO_PACKET structures.
These fields are limited to 512 bytes each and use UTF-16 encoding. However, the xrdp server converts them to UTF-8 using the ts_info_utf16_in function. Researchers found that improper buffer size validation in this conversion process can lead to a stack-based buffer overflow, enabling remote code execution.
Disclosure and Fix
Kaspersky reported the issue to the xrdp project maintainers, who responded swiftly. The vulnerability is patched in xrdp version 0.10.5, with backports to versions 0.9.27 and 0.10.4.1. A security bulletin has been issued.
“We take security seriously and grateful to the xrdp team for their fast response,” said a Kaspersky security researcher. “Users should update immediately to block potential exploits.”
What This Means
This vulnerability poses a serious risk to organizations relying on thin clients and remote desktop infrastructure. An attacker with network access could exploit CVE-2025-68670 to take control of an xrdp server without authentication. The flaw has a high severity rating and is likely to attract exploit development.
Users of Kaspersky Thin Client and USB Redirector are urged to apply the latest xrdp patches. The xrdp community recommends upgrading to version 0.10.5 or later, or applying backported patches for older releases. Administrators should review their remote desktop configurations and ensure firewall rules restrict access to trusted networks.
Timeline
- Flaw discovered during Kaspersky’s security audit of USB Redirector
- Reported to xrdp maintainers in [Month Year]
- Fix released in xrdp 0.10.5, backported to 0.9.27 and 0.10.4.1
- CVE-2025-68670 assigned
Related Articles
- Massive Facebook Account Heist: Over 30,000 Compromised in New Google AppSheet Phishing Scheme
- How to Achieve Machine-Speed Cybersecurity with Automation and AI
- 10 Critical Facts About Russia's Sneaky Router Hack to Steal Microsoft Office Tokens
- 10 Essential Strategies to Defend Your Enterprise Against AI-Powered Vulnerability Exploitation
- How to Leverage AI for Mass Vulnerability Discovery: A Guide Based on the Firefox-Claude Mythos Case
- CPU-Z Download Portal Compromised: AI-Driven EDR Foils Stealthy Watering Hole Attack in 19-Hour Breach
- 8 Critical Facts Behind Germany's Unmasking of REvil and GandCrab Leader UNKN
- 6 Critical Facts About the DarkSword iOS Exploit Chain That Threaten Your Device