What is CVE-2025-2499?

CVE-2025-2499 is a medium-severity vulnerability in Devolutions Remote Desktop Manager, classified under Improper Access Control. CVSS score: 5.4/10. Published 2025-03-26.

How severe is CVE-2025-2499?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in Devolutions Remote Desktop Manager

CVE-2025-2499

Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to bypass certain permission restrictions—specifically View Password, Edit Asset, and Edit Permissions by performing specific actions. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

EPSS: 0.004 (29.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Devolutions Remote Desktop Manager — versions 2025.1.24, 0
Devolutions Remote_desktop_manager

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

security@devolutions.net (Vendor Advisory)

Frequently asked questions

What is CVE-2025-2499?: CVE-2025-2499 is a medium-severity vulnerability in Devolutions Remote Desktop Manager, classified under Improper Access Control. CVSS score: 5.4/10. Published 2025-03-26.
How severe is CVE-2025-2499?: Medium severity. CVSS v3 base score is 5.4 out of 10.