CVE-2024-39917: xrdp allows an ininite number of login attempts
Last updated 26 June 2026
Other sources
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1~deb11u3Fixed in 0.9.21.1-1+deb12u2Fixed in 0.10.1-3.1+deb13u1Fixed in 0.10.5-5Fixed in 0.10.6-5 - Upgrade
Upgrade
xrdpto a version that resolves this vulnerability.Fixed in 0.10.0 - Configuration
Edit /etc/xrdp/sesman.ini and set MaxLoginRetry to a finite number to limit login retries (xrdp versions affected allow infinite attempts despite this parameter).
xrdp (sesman) MaxLoginRetry = set to a finite limit
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39917?
CVE-2024-39917 has a high severity level due to its potential for brute force login attacks.
How do I fix CVE-2024-39917?
To fix CVE-2024-39917, upgrade xrdp to version 0.10.0 or later.
What versions of xrdp are affected by CVE-2024-39917?
CVE-2024-39917 affects xrdp versions prior to 0.10.0.
Can CVE-2024-39917 lead to unauthorized access?
Yes, CVE-2024-39917 can allow attackers to gain unauthorized access through infinite login attempts.
Is there a configuration parameter I should check in xrdp for CVE-2024-39917?
You should check the 'MaxLoginRetry' configuration parameter in '/etc/xrdp/sesman.ini'.