CVE-2022-1736

What it actually does

The gnome-control-center RDP toggle fails to persist the disabled state across logins, causing RDP sharing to automatically re-enable on the next session without user action or notice.

Why it matters to the business

Remote desktop access may remain unintentionally exposed after users believe they have disabled it, raising the chance of unauthorized remote connections to systems.

How an attack unfolds

An attacker gains initial access or physical presence, observes or forces an RDP-enabled state, waits for the legitimate user to log out and back in, then connects remotely using the re-enabled service without triggering any alerts.

How to fix it

Disable RDP through persistent configuration files or command-line tools that survive session restarts rather than relying solely on the graphical toggle; verify the setting after each reboot and consider disabling RDP entirely if not required.

How to confirm the fix worked

After applying changes, reboot the system, log in, and confirm RDP remains disabled by inspecting both the graphical setting and the underlying configuration files or service status.

Typical attack path

1. Locate a system using GNOME desktop with RDP sharing configured
2. Confirm the control-center toggle appears to disable sharing
3. Trigger a logout and login cycle
4. Scan for active RDP listener on the target
5. Authenticate to the re-enabled service using valid credentials

How to detect it

Review system configuration files and service status after logins for unexpected RDP enablement; examine authentication and session logs for RDP listener activation without corresponding user-initiated changes.

What your security team should do

• Audit all systems for unintended RDP exposure using configuration checks
• Replace reliance on the graphical toggle with scripted or policy-based enforcement
• Monitor authentication logs for RDP connections from unexpected sources
• Disable RDP where it is not explicitly needed