CVE-2025-2528

Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to 
use a configuration different from the one mandated by the system administrators.





This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.6 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
DEVOLUTIONSCNA
---
---
CISA-ADPADP
3.6 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
VendorProductVersion
devolutionsremote_desktop_manager
𝑥
< 2024.3.31.0
devolutionsremote_desktop_manager
𝑥
< 2024.3.31.0
devolutionsremote_desktop_manager
2025.1.24.0 ≤
𝑥
< 2025.1.26.0
devolutionsremote_desktop_manager
2025.1.24.0 ≤
𝑥
< 2025.1.26.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://devolutions.net/security/advisories/DEVO-2025-0005/