CVE-2025-6523: Critical severity Devolutions Server vulnerability
Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe.
This issue affects the following versions :
Devolutions Server 2025.2.2.0 through 2025.2.3.0 Devolutions Server 2025.1.11.0 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Devolutions Serverto a version that resolves this vulnerability.Fixed in 2025.2.2.0 through 2025.2.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6523?
CVE-2025-6523 is considered a high severity vulnerability due to the ease of bypassing authentication using weak emergency codes.
How do I fix CVE-2025-6523?
To fix CVE-2025-6523, it is recommended to upgrade Devolutions Server to version 2025.2.4.0 or later.
What versions are affected by CVE-2025-6523?
CVE-2025-6523 affects Devolutions Server versions up to 2025.2.3.0 and versions up to 2025.1.11.0.
Who can exploit CVE-2025-6523?
CVE-2025-6523 can be exploited by unauthenticated attackers who can brute force the weak emergency codes.
What impact does CVE-2025-6523 have on security?
CVE-2025-6523 allows unauthorized access to systems, compromising sensitive data and overall security.