Critical Remote Code Execution Flaw in xrdp Threatens Remote Desktop Security
Kaspersky security researchers have uncovered a critical remote code execution (RCE) vulnerability, tracked as CVE-2025-68670, in the xrdp remote desktop server for Linux. The flaw could allow an attacker to execute arbitrary code on vulnerable systems, compromising remote desktop sessions.
Background
xrdp is an open-source implementation of the Remote Desktop Protocol (RDP) commonly used in thin client environments. Kaspersky integrates xrdp into its Kaspersky Thin Client operating system and offers the Kaspersky USB Redirector module to extend USB device access over remote sessions.
Vulnerability Details
The vulnerability resides in the Secure Settings Exchange phase, which occurs before client authentication. During this phase, the client sends protected credentials—including usernames, passwords, and domain names—inside a Client Info PDU (protocol data unit) as TS_INFO_PACKET structures.
These fields are limited to 512 bytes each and use UTF-16 encoding. However, the xrdp server converts them to UTF-8 using the ts_info_utf16_in function. Researchers found that improper buffer size validation in this conversion process can lead to a stack-based buffer overflow, enabling remote code execution.
Disclosure and Fix
Kaspersky reported the issue to the xrdp project maintainers, who responded swiftly. The vulnerability is patched in xrdp version 0.10.5, with backports to versions 0.9.27 and 0.10.4.1. A security bulletin has been issued.
“We take security seriously and grateful to the xrdp team for their fast response,” said a Kaspersky security researcher. “Users should update immediately to block potential exploits.”
What This Means
This vulnerability poses a serious risk to organizations relying on thin clients and remote desktop infrastructure. An attacker with network access could exploit CVE-2025-68670 to take control of an xrdp server without authentication. The flaw has a high severity rating and is likely to attract exploit development.
Users of Kaspersky Thin Client and USB Redirector are urged to apply the latest xrdp patches. The xrdp community recommends upgrading to version 0.10.5 or later, or applying backported patches for older releases. Administrators should review their remote desktop configurations and ensure firewall rules restrict access to trusted networks.
Timeline
- Flaw discovered during Kaspersky’s security audit of USB Redirector
- Reported to xrdp maintainers in [Month Year]
- Fix released in xrdp 0.10.5, backported to 0.9.27 and 0.10.4.1
- CVE-2025-68670 assigned
Related Articles
- Beyond the Endpoint: Key Data Sources for Comprehensive Threat Detection
- Massive Russian Cyber Operation Exploits Old Routers to Steal Microsoft Authentication Tokens
- Securing the npm Ecosystem: Evolving Attack Vectors and Defensive Strategies
- Unveiling DEEP#DOOR: A Python Backdoor Targeting Browser and Cloud Credentials via Tunneling
- Security Firms Checkmarx and Bitwarden Hit by Back-to-Back Supply-Chain Breaches; Ransomware Follows
- How to Fortify Your Software Against Cheap, AI-Driven Cyberattacks
- Latest Linux Kernel Releases: What You Need to Know
- A Step-by-Step Guide to Meta's Enhanced End-to-End Encrypted Backup Infrastructure