CyberRota Analysis
AI-GeneratedFreeRDP versions prior to 3.29.0 are vulnerable due to improper validation of the Extended Key Usage (EKU) purpose in peer certificates during client-side TLS authentication. This flaw allows a clientAuth-only certificate, which is valid only for client authentication, to be accepted as a server certificate, potentially enabling man-in-the-middle attacks in environments that depend on EKU separation. Organizations using FreeRDP should prioritize patching to mitigate the risk of unauthorized access and ensure secure remote desktop connections.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.