CVE-2025-2600: Medium severity Devolutions Remote Desktop Manager vulnerability
Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATEDPASSWORD variable even though not allowed by the "Allow password in variable policy".
This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2600?
The severity of CVE-2025-2600 is assessed as medium, reflecting a significant security risk due to improper authorization.
How do I fix CVE-2025-2600?
To fix CVE-2025-2600, upgrade Devolutions Remote Desktop Manager to version 2025.1.26 or later, where the vulnerability has been addressed.
Who is affected by CVE-2025-2600?
CVE-2025-2600 affects users of Devolutions Remote Desktop Manager versions from 2025.1.24 to 2025.1.25 and those prior to version 2024.3.29.
What impact does CVE-2025-2600 have on users?
CVE-2025-2600 allows unauthorized access to elevated passwords, potentially compromising sensitive information.
Is authentication required to exploit CVE-2025-2600?
Yes, authentication is required to exploit CVE-2025-2600, as it involves an authenticated password being misused.