CVE-2025-2600

MEDIUM

Devolutions Remote Desktop Manager <2024.3.31.0 & 2025.1.24-2025.1.25 - Authenticated Improper Authorization

Title source: llm
STIX 2.1

Description

Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

References (1)

Core 1

Scores

CVSS v3 6.8
EPSS 0.0036
EPSS Percentile 27.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-285
Status published
Products (1)
devolutions/remote_desktop_manager < 2024.3.31.0 (2 CPE variants)
Published Mar 26, 2025
Tracked Since Feb 18, 2026