Technical impact
The vulnerability stems from an improper error handling in the privilege drop logic of xrdp’s session execution component. When an authentication error occurs, the component fails to execute the required setuid operation, leaving child processes running with elevated root privileges. An attacker who has local authenticated access can exploit this fail‑open behavior to gain root and run arbitrary commands, potentially compromising the entire system. The weakness is categorized as CWE‑273 – Failure to Drop Privileges.
Affected Systems
neutrinolabs xrdp below version 0.10.6 is affected. All releases up to 0.10.5 contain the flaw; the vulnerability is mitigated in version 0.10.6 and later.
Risk and Exploitability
The vulnerability has a high CVSS score of 8.8, reflecting its severe impact and difficulty to exploit. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, and the flaw is not listed in the CISA KEV catalog. It is intrinsically a local, authenticated vulnerability, implying that an attacker must be able to log into the target system. As the CVE description notes, an additional exploit is required to achieve privilege escalation; the privilege drop failure alone does not automatically grant root, so the flaw can be leveraged only in combination with another exploitation technique, which still underscores the need for prompt remediation.
Debian DLA
Debian DSA