CVE-2025-2528: Low severity Devolutions Remote Desktop Manager vulnerability
Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration different from the one mandated by the system administrators.
This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2528?
CVE-2025-2528 is classified as a medium severity vulnerability due to improper authorization in application password policy.
How do I fix CVE-2025-2528?
To fix CVE-2025-2528, update Devolutions Remote Desktop Manager to version 2025.1.26 or later.
What versions are affected by CVE-2025-2528?
CVE-2025-2528 affects Devolutions Remote Desktop Manager versions from 2025.1.24 through 2025.1.25 and all versions up to 2024.3.29.
Who is affected by the CVE-2025-2528 vulnerability?
Any organization or individual using the specified versions of Devolutions Remote Desktop Manager for their remote desktop management is affected.
What causes the CVE-2025-2528 vulnerability?
CVE-2025-2528 is caused by improper authorization that allows authenticated users to bypass system administrator-configured settings.