Remote Desktop Protocol (RDP), a Microsoft-developed network communications protocol, facilitates the remote management of servers, virtual desktops, terminal servers, and applications. It operates over encrypted channels to secure sessions from unauthorized surveillance, secretly monitoring, or data manipulation, commonly known as a Man-in-the-Middle (MitM) attack. That is way RDP security is essential.
These attacks aim to steal login credentials, and personal information, or directly siphon data, posing severe financial and operational risks. In 2025, the average cost of a data breach was 4.4 M, globally.
Such incidents underscore the critical need for robust RDP security, particularly as remote work expands and employees increasingly rely on personal devices and home networks.
Remote Desktop Protocol (RDP) uses the standard network protocol TCP/IP to enable remote desktop access via port 3389. This allows users to interact with another computer’s interface through a secure, encrypted connection without physical cables like HDMI or USB.
RDP supports features like multi-monitor setups, fault tolerance, and robust authentication mechanisms, enhancing the user experience remotely. It works efficiently over WiFi, ensuring users can gain access to their desktop environments from various locations, making it ideal for remote work.
Remote Desktop Protocol (RDP) allows users to connect remotely to the Windows operating system on another computer, but it presents specific security vulnerabilities that need addressing:
By itself, RDP may not provide a sufficiently secure setup, exposing organizations to cyber risks. However, integrating strong password management, Single Sign-On (SSO), and stringent firewall rules can mitigate these vulnerabilities.
Implementing these additional security measures is crucial for protecting RDP sessions from attacks.
A notable vulnerability in RDP was related to the Credential Security Support Provider protocol, which is a component of RDP used for securing credential transfers to servers.
RDP’s vulnerability record is not historical. Microsoft’s March 2025 security update patched two critical remote code execution vulnerabilities in Windows Remote Desktop Services, CVE-2025-24035 and CVE-2025-24045, both carrying a CVSS score of 8.1 and affecting multiple Windows server and desktop versions.
Two months later, CVE-2025-29966 and CVE-2025-29967 followed: heap-based buffer overflow flaws in the Windows Remote Desktop service and RD Gateway respectively, both scoring 8.8, allowing unauthenticated attackers to send crafted packets and trigger memory corruption.
Then in July 2025, CVE-2025-48817 landed: a critical path traversal flaw in the Remote Desktop Client that lets attackers achieve remote code execution without requiring privileges, as long as a user connects to a malicious server.
Unfortunately, MitM is not the only attack on the internet. Other types of attacks can happen either on your browser, software, email, and more. Below are some common types of attacks that target RDP sessions:
This type of malware records every keystroke made on a computer, allowing attackers to capture login credentials and other sensitive information without the user’s knowledge. To protect against keyloggers, it is essential to use anti-malware software and maintain regular system updates.
Ransomware is a malicious software that encrypts the user’s data, making it inaccessible, and demands a ransom, typically in Bitcoin, to unlock it. Ransomware can be particularly destructive and costly.
Implementing robust data backups and security measures can mitigate the risks.
This exploit targets vulnerabilities in Microsoft’s software, affecting Windows Vista through Windows 10. EternalBlue has been used in some of the most damaging cyberattacks in recent history, including the infamous WannaCry ransomware attack.
It is crucial to apply all security patches and updates from Microsoft to defend against threats exploiting this vulnerability.
While Microsoft plays a critical role in patching vulnerabilities as they are disclosed, administrators and security consultants need to take proactive steps to mitigate the risks associated with Remote Desktop Protocol (RDP).
Before discussing preventive measures, it’s important to note recent issues like the Credential Security Support Provider protocol (CredSSP) vulnerability. CredSSP helps securely relay user credentials from a client to a server, and vulnerabilities in such protocols can be severe if exploited.
Here’s an effective list to ensure your RDP sessions are secure. We recommend following these 10 protective measures:
Continually update both the operating system and applications. This includes subscribing to updated services and conducting regular audits to ensure all systems are up-to-date.
Unpatched systems are a common entry point for attackers.
Beyond two-factor, consider implementing multi-factor authentication. This approach combines something you know (password), something you have (security token), and something you are (biometrics), significantly increasing security and reducing the risk of unauthorized access
Implement the principle of least privilege by ensuring users have only the access necessary for their role. Review and adjust these permissions regularly to adapt to changing roles and responsibilities.
Enforce the use of strong, unique passwords for RDP access. Employ password managers to generate and store complex passwords, and mandate regular password changes.
Avoid storing passwords in RDP files and disable the option to save credentials as a default setting on client devices. This prevents credential theft from lost or stolen devices.
Regularly clean the RDP connection cache to remove residual information that could be used in an attack. Automate this process through scripts or group policies where possible.
Require NLA for RDP sessions, which necessitates that the connecting user authenticate before a session is established, thus providing an additional layer of security against unauthorized access.
Limit RDP access through firewalls by whitelisting IP addresses. Employ additional monitoring to detect and respond to unusual access patterns or unauthorized remote access or attempts.
Use Remote Desktop Gateway servers as a middle layer to manage and secure RDP traffic entering the corporate network from remote systems. RD Gateways uses SSL encryption, improving security over traditional RDP.
Port 3389 is the first thing automated scanners look for. Changing it won’t stop a determined attacker, but it eliminates the majority of opportunistic scanning noise and reduces your exposure in logs significantly.
Open Registry Editor (regedit.exe) and navigate to:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
Find the PortNumber DWORD value. Double-click it, switch the base to Decimal, then enter your new port number. Any value in the 49152-65535 range works well. Avoid obvious alternatives like 3390 or 33890.
Close the Registry Editor and restart the server. The change doesn’t take effect until the service restarts.
Two things to do before you reconnect. First, open Windows Firewall and add a new inbound rule allowing traffic on your new port for both TCP and UDP. If you skip this, you’ll lock yourself out. Second, update your RDP client connections to include the new port — the format is IP:port (e.g. 192.168.1.5:52841).
One risk worth flagging: if you make a mistake in the registry or forget the firewall rule, you lose remote access. Always confirm you have console access, a management panel, or another out-of-band method before making this change.
While implementing the recommended security measures for your RDP connection significantly reduces the risk of cyber attacks, no system can be guaranteed 100% secure. These measures might also pose a challenge for remote users or those not well-versed in technology.
That’s where V2 Cloud shines as a key partner.
All V2 Cloud customers enjoy protection from threats like the CredSSP vulnerability because our secure Remote Desktop sessions utilize SSH tunneling through the V2 Cloud Client. This method secures all data transfers and keystrokes within your remote desktop session host and environment, and it eliminates the need to open TCP Port 3389 on your virtual machine.
Moreover, with V2 Cloud, a remote access solution, you don’t need to build your secure RDP infrastructure from scratch. Our cloud solutions, developed by a team of experts, offer a seamless and secure integration with your existing cloud infrastructure.
Opting for V2 Cloud’s remote desktop solution not only enhances security but also brings additional advanced features.
Leverage our expertise and advanced technology to ensure your remote desktop connections are safe and efficient. Explore V2 Cloud solutions today and elevate your virtual desktop security effortlessly.
Exposing RDP directly to the internet is the highest-risk configuration. The minimum viable approach is to place RDP behind a VPN so the port is never publicly reachable, combined with Network Level Authentication (NLA), MFA, and an account lockout policy to limit brute-force attempts.
If a VPN isn’t an option, an RD Gateway with TLS encryption is the next best alternative. Changing the default port 3389 reduces automated scanning noise but is not a substitute for any of the above.
On Windows 10, start by enabling Network Level Authentication, which requires users to authenticate before a full RDP session is established. Go to System Properties, select the Remote tab, and check “Allow connections only from computers running Remote Desktop with Network Level Authentication."
From there, restrict which users have Remote Desktop access, enable Windows Firewall rules that limit RDP to specific IP addresses only, and ensure the machine is current on Windows updates given the volume of RDP-related CVEs patched in recent years.
RDP supports TLS encryption natively, but it needs to be enforced rather than left on its default negotiated setting.
In Group Policy, navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security, and set “Require use of specific security layer for remote connections" to SSL (TLS 1.2 or higher).
Pair this with a valid certificate from a trusted CA rather than the self-signed certificate Windows generates by default. Self-signed certificates are vulnerable to man-in-the-middle attacks because clients cannot properly verify the server’s identity.
Your V2 CloudCare team — real people, on the line.
