Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-2600

Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

Published

2025-03-26T18:15:26.437

Last Modified

2025-08-26T18:15:47.157

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.8 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-285
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application devolutions remote_desktop_manager < 2024.3.31.0 Yes
Application devolutions remote_desktop_manager < 2024.3.31.0 Yes
Application devolutions remote_desktop_manager < 2025.1.26.0 Yes
Application devolutions remote_desktop_manager < 2025.1.26.0 Yes
References