CVE-2024-39917
xrdp allows an ininite number of login attempts
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
xrdp allows an ininite number of login attempts
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
- Record
CVE-2024-39917- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L - Weakness
- CWE-307
- Updated
- 2026-11-02
EUVDEUVD-2024-38299
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
- Record
EUVD-2024-38299- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L - Updated
- 2026-11-02
NVD
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
- Record
CVE-2024-39917- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-307
- Updated
- 2026-11-02
OSV
xrdp allows an ininite number of login attempts
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
- Record
CVE-2024-39917- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L - Weakness
- CWE-307
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-39917
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
- Record
DEBIAN-CVE-2024-39917- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-39917
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts.
- Record
UBUNTU-CVE-2024-39917- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVMGASA-2025-0044 No score
Updated xrdp packages fix security vulnerability
xrdp allows an infinite number of login attempts. (CVE-2024-39917)
- Record
MGASA-2025-0044- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10816-1 No score
libpainter0-0.9.27-2.1 on GA media
These are all security issues fixed in the libpainter0-0.9.27-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10816-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0335-1 No score
Security update for xrdp
This update for xrdp fixes the following issues:
- CVE-2024-39917: Enforce no login screen if require_credentials is set (bsc#1227769)
- Record
SUSE-SU-2025:0335-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0336-1 No score
Security update for xrdp
This update for xrdp fixes the following issues:
- CVE-2024-39917: Enforce no login screen if require_credentials is set (bsc#1227769)
- Record
SUSE-SU-2025:0336-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0350-1 No score
Security update for xrdp
This update for xrdp fixes the following issues:
- CVE-2024-39917: Enforce no login screen if require_credentials is set (bsc#1227769)
- Record
SUSE-SU-2025:0350-1- Updated
- 2026-11-02
OSVUSN-8476-1 No score
xrdp vulnerabilities
It was discovered that xrdp incorrectly handled bounds checking when processing user domain information during the connection sequence. An unauthenticated remote attacker could use this issue to cause xrdp to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-68670)
It was discovered that xrdp did not correctly enforce the maximum number of login attempts configured by the MaxLoginRetry parameter. A remote attacker could use this issue to perform an unlimited number of login attempts. (CVE-2024-39917)
It was discovered that xrdp did not perform bounds checking when accessing font glyphs. Since some of this data is controllable by the user, a remote attacker could use this issue to cause xrdp to read out of bounds. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-42822)
It was discovered that xrdp did not properly handle session establishment errors. A remote attacker could use this issue to bypass OS-level session restrictions enforced by PAM, such as the maximum number of concurrent sessions per user. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-40184)
- Record
USN-8476-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xrdpDebian:12 |
before 0.9.21.1-1+deb12u1, plus listed versions 0.9.21.1-1 |
0.9.21.1-1+deb12u1 |
xrdpDebian:13 |
before 0.10.1-1 | 0.10.1-1 |
xrdpDebian:14 |
before 0.10.1-1 | 0.10.1-1 |
xrdpDebian:11 From an advisory covering 3 CVEs |
before 0.9.21.1-1~deb11u2, plus listed versions 0.9.12-1.10.9.15-10.9.17-10.9.17-20.9.17-2.10.9.19-10.9.21.1-1~deb11u1 |
0.9.21.1-1~deb11u2 |
xrdpMageia:9 |
before 0.9.23.1-1.1.mga9 | 0.9.23.1-1.1.mga9 |
xrdpSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 0.9.10-3.19.1 | 0.9.10-3.19.1 |
xrdpSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 0.9.10-3.19.1 | 0.9.10-3.19.1 |
xrdpSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 0.9.13.1-150600.15.3.1 | 0.9.13.1-150600.15.3.1 |
xrdpopenSUSE:Leap 15.6 |
before 0.9.13.1-150600.15.3.1 | 0.9.13.1-150600.15.3.1 |
xrdpSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xrdpSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Manager Proxy 4.3 |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Manager Server 4.3 |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpSUSE:Enterprise Storage 7.1 |
before 0.9.13.1-150200.4.33.1 | 0.9.13.1-150200.4.33.1 |
xrdpUbuntu:Pro:18.04:LTS |
before 0.9.5-2ubuntu0.1~esm3, plus listed versions 0.9.1-90.9.4-10.9.4-20.9.4-30.9.4-4 Show 6 moreShow less0.9.4-50.9.5-10.9.5-1build10.9.5-20.9.5-2ubuntu0.1~esm10.9.5-2ubuntu0.1~esm2 |
0.9.5-2ubuntu0.1~esm3 |
xrdpUbuntu:Pro:20.04:LTS |
before 0.9.12-1ubuntu0.1+esm2, plus listed versions 0.9.9-10.9.12-10.9.12-1ubuntu0.10.9.12-1ubuntu0.1+esm1 |
0.9.12-1ubuntu0.1+esm2 |
xrdpUbuntu:Pro:22.04:LTS |
before 0.9.17-2ubuntu3+esm2, plus listed versions 0.9.15-1ubuntu10.9.17-10.9.17-20.9.17-2ubuntu10.9.17-2ubuntu20.9.17-2ubuntu2+esm10.9.17-2ubuntu30.9.17-2ubuntu3+esm1 |
0.9.17-2ubuntu3+esm2 |
xrdpUbuntu:Pro:24.04:LTS |
before 0.9.24-4ubuntu0.1~esm1, plus listed versions 0.9.21.1-10.9.24-20.9.24-30.9.24-3build10.9.24-3build20.9.24-4 |
0.9.24-4ubuntu0.1~esm1 |
xrdpUbuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 0.9.5-2ubuntu0.1~esm3, plus listed versions 0.9.1-90.9.4-10.9.4-20.9.4-30.9.4-4 Show 6 moreShow less0.9.4-50.9.5-10.9.5-1build10.9.5-20.9.5-2ubuntu0.1~esm10.9.5-2ubuntu0.1~esm2 |
0.9.5-2ubuntu0.1~esm3 |
xrdpUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 0.9.12-1ubuntu0.1+esm2, plus listed versions 0.9.9-10.9.12-10.9.12-1ubuntu0.10.9.12-1ubuntu0.1+esm1 |
0.9.12-1ubuntu0.1+esm2 |
xrdpUbuntu:Pro:22.04:LTS From an advisory covering 4 CVEs |
before 0.9.17-2ubuntu3+esm2, plus listed versions 0.9.15-1ubuntu10.9.17-10.9.17-20.9.17-2ubuntu10.9.17-2ubuntu20.9.17-2ubuntu2+esm10.9.17-2ubuntu30.9.17-2ubuntu3+esm1 |
0.9.17-2ubuntu3+esm2 |
xrdpUbuntu:Pro:24.04:LTS From an advisory covering 4 CVEs |
before 0.9.24-4ubuntu0.1~esm1, plus listed versions 0.9.21.1-10.9.24-20.9.24-30.9.24-3build10.9.24-3build20.9.24-4 |
0.9.24-4ubuntu0.1~esm1 |
xrdpUbuntu:25.10 From an advisory covering 4 CVEs |
before 0.10.1-3.1+deb13u1build0.25.10.1, plus listed versions 0.10.1-30.10.1-3.1 |
0.10.1-3.1+deb13u1build0.25.10.1 |
xrdpopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 0.9.27-2.1 | 0.9.27-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-39917 is a high vulnerability (CVSS 7.2) in Neutrinolabs Xrdp, published July 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in xrdp 0.9.21.1-1+deb12u1.
References
github.com/neutrinolabs/xrdp/security/advisories/GHSA-7w22-h4w7-8j5j
lists.debian.org/debian-lts-announce/2025/05/msg00018.html
nvd.nist.gov/vuln/detail/CVE-2024-39917
security-tracker.debian.org/tracker/CVE-2024-39917
Show 21 moreShow less
advisories.mageia.org/MGASA-2025-0044.html
bugs.mageia.org/show_bug.cgi?id=33985
lists.opensuse.org/archives/list/[email protected]/message/FMYGECEBC7XEBNQ2ZHXYRQBLCMHHXKP5
suse.com/support/update/announcement/2025/suse-su-20250335-1
bugzilla.suse.com/1227769
ubuntu.com/security/CVE-2024-39917
cve.org/CVERecord?id=CVE-2024-39917