CVE-2025-2528

Published: Mar 26, 2025Modified: Jun 17, 2026

3.6

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 1.0 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration different from the one mandated by the system administrators. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

Affected (4)

Products: Devolutions: Remote Desktop Manager

Devolutions

1 product

Remote Desktop Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Devolutions Remote Desktop Manager	Before 2024.3.31.0
Devolutions Remote Desktop Manager	From 2025.1.24.0 to 2025.1.26.0
Devolutions Remote Desktop Manager	Before 2024.3.31.0
Devolutions Remote Desktop Manager	From 2025.1.24.0 to 2025.1.26.0

Related CWEs

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://devolutions.net/security/advisories/DEVO-2025-0005/

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.