CVE-2025-2528

Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration different from the one mandated by the system administrators. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

CVSS v3 3.6 LOW

3.6^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.0 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2025-0005/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:devolutions:remote_desktop_manager:::::free:windows::
	cpe:2.3:a:devolutions:remote_desktop_manager:::::team:windows::
	cpe:2.3:a:devolutions:remote_desktop_manager:::::free:windows::
	cpe:2.3:a:devolutions:remote_desktop_manager:::::team:windows::

History

No history.

Information

Published : 2025-03-26 18:15

Updated : 2025-07-02 17:32

NVD link : CVE-2025-2528

Mitre link : CVE-2025-2528

CVE.ORG link : CVE-2025-2528

JSON object : View

Products Affected

devolutions

remote_desktop_manager

CWE

CWE-285

Improper Authorization

{"id": "CVE-2025-2528", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.6, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.0}]}, "published": "2025-03-26T18:15:26.020", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2025-0005/", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to \nuse a configuration different from the one mandated by the system administrators.\n\n\n\n\n\nThis issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29."}, {"lang": "es", "value": "Una autorizaci\u00f3n incorrecta en la pol\u00edtica de contrase\u00f1as de la aplicaci\u00f3n en Devolutions Remote Desktop Manager en Windows permite que un usuario autenticado utilice una configuraci\u00f3n distinta a la establecida por los administradores del sistema. Este problema afecta a las versiones de Remote Desktop Manager desde la 2025.1.24 hasta la 2025.1.25, y a todas las versiones hasta la 2024.3.29."}], "lastModified": "2025-07-02T17:32:48.233", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:free:windows:*:*", "vulnerable": true, "matchCriteriaId": "0C146019-3232-4413-BB31-AC876E37BFE5", "versionEndExcluding": "2024.3.31.0"}, {"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:team:windows:*:*", "vulnerable": true, "matchCriteriaId": "183673B7-2357-4FA7-98E7-32F986B65BC3", "versionEndExcluding": "2024.3.31.0"}, {"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:free:windows:*:*", "vulnerable": true, "matchCriteriaId": "3A6A560B-95F7-419D-8B56-7327BC2164B1", "versionEndExcluding": "2025.1.26.0", "versionStartIncluding": "2025.1.24.0"}, {"criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:team:windows:*:*", "vulnerable": true, "matchCriteriaId": "367DF58A-9A33-46BD-AB77-74B7B8A4E48E", "versionEndExcluding": "2025.1.26.0", "versionStartIncluding": "2025.1.24.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}