Found from VA Report Remote Desktop Protocol Server Man-in-the-Middle Weakness in Solarwinds Server

Samyul Kabir Samy 0 Reputation points
2026-10-27T09:20:07.0033333+00:00

The remote version of the Remote Desktop Protocol Server (Terminal Service) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP client makes no effort to validate the identity of the server when setting up encryption. An attacker with the ability to intercept traffic from the RDP server can establish encryption with the client and server without being detected. A MiTM attack of this nature would allow the attacker to obtain any sensitive information transmitted, including authentication credentials.
Port: 3389
Protocol: TCP
kindly advice the remediation steps to resolve this issue on Solarwinds.

Windows for business | Windows Server | User experience | Remote desktop services and terminal services

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Chance Maurice Niyonzima 825 Reputation points Independent Advisor
    2026-10-27T10:09:38.9833333+00:00

    Hello Samy,

    Thank you for posting your question on the Microsoft Windows Forum!

    The most important finding is that the vulnerability report references:

    CVE-2005-1794

    which is a legacy Remote Desktop Protocol (RDP) man-in-the-middle vulnerability associated with older RDP/Terminal Services implementations, not a vulnerability that is specific to SolarWinds.

    What this means

    The reported weakness is generally associated with environments where RDP clients cannot adequately validate the identity of the RDP server, creating a risk of server impersonation or man-in-the-middle attacks.

    The most important point to clarify is whether the vulnerability scanner is reporting this finding against the Windows RDP service itself or against a SolarWinds-managed component.

    CVE-2005-1794 is associated with legacy RDP server identity validation behavior rather than a SolarWinds-specific vulnerability. Once we determine which component was flagged, we can verify whether protections such as Network Level Authentication (NLA) and RDP certificate validation are already in place.

    Could you share:

    The Windows Server version
The vulnerability scanner used (Nessus, Qualys, Rapid7, etc.)
Whether the finding was reported on the Windows host or on a SolarWinds component

    Highest-value next step

    Could you clarify what you mean by:

    connect an agent in comment section

    and identify:

    The SolarWinds product involved (Orion, NPM or SAM)
The Windows Server version
The vulnerability scanner used (Tenable, Nessus, Qualys or Rapid7)

    This is important because some scanners may flag CVE-2005-1794 based on RDP configuration or protocol detection even when the underlying SolarWinds application is not the affected component.

    Microsoft References

    The results of those checks will help determine whether this is a genuine RDP exposure, a configuration issue, or a scanner finding that requires a different remediation approach.

    I hope this answer has brought you useful information. If so, please click on Accept Answer and consider upvoting it. Doing so helps other community members identify useful solutions to similar issues.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.