RDP:

Vulnerability Discovery

Detect BlueKeep, DejaBlue, and missing NLA on RDP hosts

2 guides • Created Dec 28, 2025 • Updated May 15, 2026

2 guides

RDP Known Vulnerability Detection

Identifies known RDP vulnerabilities including BlueKeep, DejaBlue, and misconfigurations using Nmap scripts, Metasploit modules, and manual version checks.

May 15, 2026 • 3 min read

RDP NLA Not Enforced

Identifies RDP servers lacking Network Level Authentication, enabling pre-authentication attacks and brute force without valid credentials.

May 15, 2026 • 3 min read

RDP vulnerability discovery checks for configuration weaknesses and known CVEs that expose the service. Start with NLA: when disabled, the server presents a full login screen to unauthenticated users, enabling brute-force attacks and information disclosure. rdp-sec-check and Nmap scripts detect this quickly.

BlueKeep (CVE-2019-0708) affects Windows 7, Server 2008, and Server 2008 R2 with RDP enabled. Scan for it using Metasploit's auxiliary/scanner/rdp/cve_2019_0708_bluekeep or rdpscan. Unpatched systems are increasingly rare on the internet but still appear in internal networks and legacy environments.

Weak encryption (Standard RDP Security without NLA) allows man-in-the-middle attacks. SMB signing and RDP security settings often correlate, so weak RDP configuration hints at broader issues. Check for exposed RDP without MFA, since RDP with only password authentication on internet-facing hosts is a critical finding regardless of patch level.