I found a PoC for a MitM-attack towards RDP published in March 2017 but no CVE in any of the databases and no mention of a patch by Microsoft.

I want to know if this still works, how would I find out without testing it myself?

  • The paper says it's not a CVE-type problem, it's a misconfig.
    – schroeder
    Commented Jul 6, 2017 at 10:37

1 Answer 1


The issue described in the paper is not an actual vulnerability, but rather the consequence of using untrusted certificates in the environment. When connecting to a remote RDP server, it uses by default a self-signed certificate. When you accept that certificate, you trust the remote system. If this is the way in your network, then attacker can set up a proxy server and proxy all your RDP traffic through his system, e.g. perform a man-in-the-middle attack. It starts when you accept attacker’s certificate and establish the connection.

To avoid this issue, you need to use trusted certificates, signed by trusted CA. And when the remote server offers an untrusted certificate, you should suspect that something is wrong. It is the same issue as with web browsers and fake certificates.

The bottom line, if your organization is using self-signed certificates, it is vulnerable to this attack.

Here are some articles on how to configure your RDP servers to use trusted certificates: https://blogs.technet.microsoft.com/enterprisemobility/2010/04/09/configuring-remote-desktop-certificates/


  • Thanks for you answer. To add to your point though: Correct me if I'm wrong, but couldn't using the same public/private key pair for every connection be considered a vulnerability?
    – Tom K.
    Commented Jul 6, 2017 at 10:37
  • 1
    @Tom A vulnerability, yes, but not a design vulnerability, so there is no CVE that needs to be created.
    – schroeder
    Commented Jul 6, 2017 at 10:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .