Description
Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack. Versions affected are : Remote Desktop Manager macOS 2024.3.9.0 and earlier Remote Desktop Manager Linux 2024.3.2.5 and earlier Remote Desktop Manager Android 2024.3.3.7 and earlier Remote Desktop Manager iOS 2024.3.3.0 and earlier Remote Desktop Manager Powershell 2024.3.6.0 and earlier
References (1)
Core 1
Core References
Vendor Advisory
https://devolutions.net/security/advisories/DEVO-2025-0001/
Scores
CVSS v3
8.8
EPSS
0.0022
EPSS Percentile
12.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-295
Status
published
Products (5)
devolutions/remote_desktop_manager
< 2024.3.10.3
devolutions/remote_desktop_manager
< 2024.3.2.9
devolutions/remote_desktop_manager
< 2024.3.4.0
devolutions/remote_desktop_manager
< 2024.3.4.2
devolutions/remote_desktop_manager_powershell
< 2024.3.7
Published
Feb 10, 2025
Tracked Since
Feb 18, 2026