Read the docs
TI-2002-00838 Aliases CVE-2002-0863GHSA-5hh8-598f-9j69

Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows…

Priority MEDIUM 43Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Remote Data Protocol (RDP) version 5.0 in Microsoft Windows 2000 and RDP 5.1 in Windows XP does not encrypt the checksums of plaintext session data, which could allow a remote attacker to determine the contents of encrypted sessions via sniffing, aka "Weak Encryption in RDP Protocol."

Why it matters now

EPSS 0.21976 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:.net_windows_server:beta3:*:standard:*:*:*:*:*beta3VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_2000_terminal_services:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp1:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp2:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp3:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_nt:4.0:*:terminal_server:*:*:*:*:*4.0VulnerableMicrosoft
  • cpe:2.3:a:microsoft:.net_windows_server:beta3:*:standard:*:*:*:*:* Versions beta3 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_2000:*:sp2:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_2000:*:sp3:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_2000_terminal_services:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp1:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp2:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_2000_terminal_services:*:sp3:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_nt:4.0:*:terminal_server:*:*:*:*:* Versions 4.0 Vulnerable ·Microsoft
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_nt:4.0:sp1:terminal_server:*:*:*:*:*4.0 sp1VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_nt:4.0:sp2:terminal_server:*:*:*:*:*4.0 sp2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_nt:4.0:sp3:terminal_server:*:*:*:*:*4.0 sp3VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_nt:4.0:sp4:terminal_server:*:*:*:*:*4.0 sp4VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_nt:4.0:sp5:terminal_server:*:*:*:*:*4.0 sp5VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_nt:4.0:sp6:terminal_server:*:*:*:*:*4.0 sp6VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:terminal_server:*:*:*:*:*4.0 sp6aVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*all versionsVulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_nt:4.0:sp1:terminal_server:*:*:*:*:* Versions 4.0 sp1 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_nt:4.0:sp2:terminal_server:*:*:*:*:* Versions 4.0 sp2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_nt:4.0:sp3:terminal_server:*:*:*:*:* Versions 4.0 sp3 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_nt:4.0:sp4:terminal_server:*:*:*:*:* Versions 4.0 sp4 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_nt:4.0:sp5:terminal_server:*:*:*:*:* Versions 4.0 sp5 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_nt:4.0:sp6:terminal_server:*:*:*:*:* Versions 4.0 sp6 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:terminal_server:*:*:*:*:* Versions 4.0 sp6a Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_xp:*:*:64-bit:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_xp:*:sp1:64-bit:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:* Versions all versions Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2002-0863
  2. 2026-10-03 Alias added: GHSA-5hh8-598f-9j69

References

Advisory 3

Other 4

  • TI-2002-00839 The Remote Data Protocol (RDP) version 5.1 in Microsoft Windows XP allows remote… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences