CVE-2025-2600

Published: Mar 26, 2025Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Exploitability: 2.1 / Impact: 4.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

Affected (4)

Products: Devolutions: Remote Desktop Manager

Devolutions

1 product

Remote Desktop Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Devolutions Remote Desktop Manager	Before 2024.3.31.0
Devolutions Remote Desktop Manager	From 2025.1.24.0 to 2025.1.26.0
Devolutions Remote Desktop Manager	Before 2024.3.31.0
Devolutions Remote Desktop Manager	From 2025.1.24.0 to 2025.1.26.0

Related CWEs

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://devolutions.net/security/advisories/DEVO-2025-0005/

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.