xrdp, an open source RDP server, through version 0.10.5, fails to validate the 8-byte MAC signature on encrypted RDP packets under the Classic RDP Security layer. While the sender generates the MAC correctly, the receiver ignores it, resulting in improper validation of the integrity check value (CWE-354). This flaw enables a man-in-the-middle attacker to alter encrypted traffic undetected. The vulnerability is mitigated by enforcing the TLS security layer or upgrading to version 0.10.6 where the issue is fixed.

An unauthenticated attacker with man-in-the-middle capabilities can modify encrypted RDP traffic without detection when the Classic RDP Security layer is used. This compromises the integrity of the communication channel, potentially allowing tampering with data in transit. The vulnerability does not impact connections secured with TLS, which properly enforce integrity checks.

A fix is available in xrdp version 0.10.6. Users should upgrade to this version to resolve the vulnerability. If immediate upgrade is not possible, users must configure xrdp.ini to enforce the TLS security layer by setting security_layer=tls, which ensures end-to-end integrity validation and mitigates the risk.