xrdp Unauthenticated Stack Buffer Overflow via RDP Connection Sequence
CVE-2025-68670 is a critical (CVSS 9.1) unauthenticated stack-based buffer overflow vulnerability in xrdp, the open-source RDP server widely deployed on Linux systems. The vulnerability stems from improper bounds checking when processing user domain information during the RDP connection sequence (pre-authentication). An unauthenticated remote attacker can overwrite the stack buffer and return address, potentially redirecting execution flow to execute arbitrary code. Fixed in xrdp v0.10.5. The impact is partially mitigated if the binary was compiled with stack canary protection, though the advisory warns against relying on this for production systems. xrdp is commonly used to provide RDP access to Ubuntu, Debian, CentOS, and other Linux servers — including cloud VMs, developer workstations, and Linux-based infrastructure in SMB environments. Exploitation requires no credentials and only network access to port 3389.
// CVE-2025-68670 — xrdp Unauthenticated Stack Buffer Overflow
// Detect exploitation attempts against xrdp on port 3389
// via malformed RDP connection sequences with oversized domain fields
let RDPPort = 3389;
let SuspiciousRDPSources = (
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == RDPPort
| where DeviceVendor !in ("Microsoft") // Filter out Windows RDP, focus on Linux xrdp
| summarize ConnectionCount=count(), UniqueSourceIPs=dcount(SourceIP)
by DestinationIP, bin(TimeGenerated, 1h)
| where ConnectionCount > 20 // High connection rate = scanning/exploitation
);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == RDPPort
| join kind=inner SuspiciousRDPSources on DestinationIP
| extend ThreatIndicator = "CVE-2025-68670-xrdp-BufferOverflow"
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort,
DeviceVendor, Message, Action, ConnectionCount, UniqueSourceIPs
| sort by ConnectionCount descData Sources
Required Tables
False Positives
- Legitimate high-frequency RDP connections from terminal servers or RDP session brokers
- Vulnerability scanners performing authorised RDP service discovery
- RDP load testing or automation frameworks
References (5)
Unlock Pro Content
Get the full detection package for CVE-2025-68670 including response playbook, investigation guide, and atomic red team tests.