CVE-2024-39917VulnerabilityPublished 12 Jul 2024Updated 3 Nov 2025

CVE-2024-39917: neutrinolabs xrdp · Improper Restriction of Excessive Authentication Attempts

Affects neutrinolabs xrdpSource CVE Database V5

Not known to be exploited · CVSS 7.2 High.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

7.2High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.6% chance of exploitation in 30 days – higher than 48% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: Low
Integrity: None
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Jul 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
GitHubneutrinolabs/xrdp`pkg:github/neutrinolabs/xrdp`Other threats	Affected <=0.10.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

To mitigate CVE-2024-39917, European organizations should take the following specific actions: 1) Upgrade xrdp to a version later than 0.10.0 once an official patch addressing this vulnerability is released by neutrinolabs. 2) Until a patch is available, implement external rate-limiting controls on the network perimeter or host-based firewalls to restrict the number of authentication attempts from a single IP address. 3) Deploy intrusion detection and prevention systems (IDS/IPS) with signatures or heuristics to detect and block brute-force login attempts against xrdp services. 4) Enforce strong password policies and multi-factor authentication (MFA) for all remote desktop access to reduce the risk of credential compromise. 5) Monitor authentication logs closely for unusual login patterns or repeated failed attempts and respond promptly to suspicious activity. 6) Consider isolating xrdp services behind VPNs or zero-trust network access (ZTNA) solutions to limit exposure to the public internet. 7) Regularly audit and update configuration files, ensuring MaxLoginRetry and other security parameters are correctly set and effective. 8) Educate system administrators and users about the risks of brute-force attacks and the importance of secure remote access practices. These measures collectively reduce the attack surface and improve detection and response capabilities.

Description

xrdp is an open source RDP server.xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.

Impact

For European organizations, the impact of CVE-2024-39917 can be substantial. Many enterprises and public sector entities in Europe use Linux-based systems with xrdp to provide remote desktop access, especially in hybrid and remote work environments. The vulnerability enables attackers to perform unlimited brute-force attempts, increasing the risk of credential compromise and unauthorized access to sensitive systems. This can lead to data breaches, lateral movement within networks, and potential disruption of critical services. The partial confidentiality impact means that attackers may gain access to user accounts or sensitive information if credentials are cracked. The availability impact could manifest as denial of service if authentication services are overwhelmed or accounts are locked out. Given the regulatory environment in Europe, including GDPR, unauthorized access and data breaches could result in significant legal and financial penalties. Organizations in sectors such as finance, healthcare, government, and critical infrastructure are particularly at risk due to the sensitive nature of their data and services. The vulnerability also poses a risk to managed service providers and cloud environments that use xrdp for remote management. Without mitigation, attackers could exploit this flaw to gain persistent footholds or disrupt operations.

Summary

The vulnerability CVE-2024-39917 affects neutrinolabs xrdp, an open-source Remote Desktop Protocol (RDP) server widely used on Linux systems. Versions up to and including 0.10.0 fail to enforce the configured maximum login attempts parameter, MaxLoginRetry, located in /etc/xrdp/sesman.ini. This misconfiguration or implementation flaw allows attackers to attempt an unlimited number of authentication attempts without being blocked or throttled. The vulnerability is classified under CWE-307, which concerns improper restriction of excessive authentication attempts. Exploiting this flaw requires no authentication or user interaction and can be performed remotely over the network. The primary risk is that attackers can conduct brute-force password guessing attacks indefinitely, increasing the likelihood of credential compromise. Additionally, the unlimited login attempts can be leveraged to cause denial of service by overwhelming the authentication subsystem or locking out legitimate users through account lockout policies if implemented externally. The CVSS v3.1 base score of 7.2 reflects a high severity due to network accessibility, low attack complexity, no privileges or user interaction needed, and a scope change where confidentiality is partially impacted and availability is degraded. Although no known exploits are reported in the wild at the time of publication, the vulnerability presents a significant risk to any organization exposing xrdp services, especially those with weak or reused credentials. The lack of an effective login attempt limit undermines a fundamental security control designed to prevent brute-force attacks, making this a critical issue for administrators to address promptly.

CWE-307Improper Restriction of Excessive Authentication Attempts (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Architecture and Design
Common protection mechanisms include: Disconnecting the user after a small number of failed attempts; Implementing a timeout; Locking out a targeted account; Requiring a computational task on the user's part.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
Authentication (opens in a new tab)
Transport Layer Protection (opens in a new tab)
TLS Cipher String (opens in a new tab)
OWASP ASVS 4.0.3
V2.2.1 (opens in a new tab)
V2.8.5 (opens in a new tab)
V2.8.4 (opens in a new tab)
Attack patterns
Dictionary-based Password Attack (opens in a new tab)
Password Brute Forcing (opens in a new tab)
Password Spraying (opens in a new tab)
Credential Stuffing (opens in a new tab)
Use of Known Kerberos Credentials (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 3 Nov 2025, 19:55 UTC

WeaknessesCWE-307

Technical details

References

Community reviews

Related threats