CVEvulnerability

CVE-2025-2600

6.8 MEDIUM Published 2025-03-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2025-03-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-285

Description

Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

Affected configurations

• devolutions remote desktop manager (< 2024.3.31.0) • devolutions remote desktop manager (>= 2025.1.24.0 < 2025.1.26.0)

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References