cbcvebase.
CVE-2022-22017
published 2022-05-10

CVE-2022-22017: Remote Desktop Client Remote Code Execution Vulnerability

PriorityP264high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
37.10%
98.3th percentile
Remote Desktop Client Remote Code Execution Vulnerability

Affected

7 ranges
VendorProductVersion rangeFixed in
microsoftremote_desktop_client_for_windows_desktop>= 1.2.0.0 < 1.2.31301.2.3130
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.67510.0.22000.675
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.70710.0.20348.707
msrcremote_desktop_client_for_windows_desktop
msrcwindows_11_version_21h2_for_arm64-based_systems
msrcwindows_11_version_21h2_for_x64-based_systems
msrcwindows_server_2022

Detection & IOCsextracted from sources · hover to see the quote

  • Attacker must control a malicious RDP server that a victim connects to; monitor for outbound RDP connections to untrusted/external hosts, particularly on TCP 3389
  • Exploitation assessed as 'More Likely' for both latest and older software releases; prioritize detection and patching of Remote Desktop Client across all supported versions
  • Social engineering is the initial vector; alert on user-initiated RDP client connections to external or newly-seen RDP endpoints
  • ·This is a client-side RCE triggered when the victim connects outbound to a malicious RDP server; the attack surface is the Remote Desktop Client, not the RDP server/listener
  • ·Customer action is required; patching alone is insufficient without ensuring users do not connect to untrusted RDP servers

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
cisa5.3MEDIUM
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.