CVE-2021-42098

CVE-2021-42098 affects Devolutions Remote Desktop Manager; there is an incomplete permission check on entries prior to version 2021.2.16, allowing permission bypass via batch custom PowerShell. The available connected documents indicate the issue stems from improper access control rather than a v...

CVE-2021-23922

CVE-2021-23922 refers to a cross-site scripting (XSS) vulnerability in Devolutions Remote Desktop Manager (webviews) affecting versions prior to 2020.2.12 . The issue is documented across multiple sources (NVD/CNVD/CVE listings) with CVSS metrics indicating a network-exposed vulnerability, mitiga...

CVE-2022-3182

CVE-2022-3182 affects Devolutions Remote Desktop Manager (DRDM) version 2022.2.14 and earlier, due to an Improper Access Control vulnerability in the Duo SMS two-factor authentication that allows bypassing the application lock. The issue is documented across multiple sources (including Red Hat an...

CVE-2023-4373

CVE-2023-4373 concerns Devolutions Remote Desktop Manager (versions ≤ 2023.2.19). The issue is inadequate validation of permissions when using remote tools and macros, allowing a user to initiate a connection without proper execution rights via the remote tools feature. Affected software: Devolut...

CVE-2022-4287

The CVE-2022-4287 vulnerability affects Devolutions Remote Desktop Manager for Windows, specifically versions 2022.3.26 and earlier, where an authentication bypass in the local application lock feature allows a malicious user to access the application. The connected documents provide the affected...

CVE-2025-1193

Devolutions Remote Desktop Manager versions 2024.3.19 and earlier on Windows are vulnerable to a trust management issue due to improper host validation in the certificate validation component. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack by presenting a certificate fo...

CVE-2022-3641

CVE-2022-3641 affects Devolutions Remote Desktop Manager: versions 2022.3.13–2022.3.24 expose an elevation-of-privilege vulnerability via the Azure SQL Data Source, allowing an authenticated user to spoof a privileged account. Root cause and technical details are described across multiple connect...

CVE-2024-7421

The vulnerability CVE-2024-7421 affects Devolutions Remote Desktop Manager (versions up to 2024.2.20.0) on Windows. The issue is an information exposure where credentials used for WinSCP sessions can be retrieved by local attackers who can access system logs, via passwords found in command-line a...

CVE-2022-1342

CVE-2022-1342 affects Devolutions Remote Desktop Manager (pre- and including 2022.1.24). The root cause is a lack of password masking and a caching issue that can leave sensitive fields visible when panels are closed and reopened, enabling physically proximate attackers to observe data. The conne...

CVE-2022-2221

CVE-2022-2221 concerns an Information Exposure vulnerability in the Devolutions Remote Desktop Manager product. The issue affects versions prior to 2022.1.8 and resides in the My Account Settings area, where authenticated users could access credentials of other users. The connected documents conf...

CVE-2025-1635

The Devolutions Remote Desktop Manager on Windows (versions 2024.3.29 and earlier ) is affected by a security vulnerability (CVE-2025-1635 ) resulting from faulty business logic in the hub data source export feature. This flaw allows an authenticated user to inadvertently include their authentica...

CVE-2022-3780

CVE-2022-3780 affects Devolutions Remote Desktop Manager, with the vulnerability arising from deleted users’ database connections staying active on MySQL data sources. This can allow deleted users to access unauthorized data in Remote Desktop Manager 2022.3.7 and prior versions. The issue is docu...

CVE-2023-1203

CVE-2023-1203 affects Devolutions Remote Desktop Manager PowerShell Module, Hub Business submodule. The vulnerability stems from improper removal of sensitive data during entry edits, allowing an authenticated user to access sensitive data on entries edited with the affected submodule. Affected v...

CVE-2022-33995

CVE-2022-33995 describes a path traversal in Devolutions Remote Desktop Manager (RDM) prior to version 2022.2, specifically in the handling of entry attachments. The root cause is a path traversal flaw that could allow an attacker to create or overwrite files in arbitrary locations on the affecte...

CVE-2025-2528

The Devolutions Remote Desktop Manager on Windows is vulnerable to an improper authorization flaw in the application password policy. This allows an authenticated user to use a configuration that deviates from the rules mandated by system administrators. This issue affects versions 2025.1.24 thro...

CVE-2022-26964

The CVE-2022-26964 entry concerns Devolutions Remote Desktop Manager prior to version 2022.1, where weak password derivation for export enables information disclosure via a password brute-force attack. The underlying issue is an error that causes base64 to be decoded, contributing to the weakness...

CVE-2022-3781

CVE-2022-3781 affects Devolutions Remote Desktop Manager (versions 2022.2.26 and earlier) and Devolutions Server (versions 2022.3.1 and earlier). The root cause is that Dashlane passwords and Keepass Server passwords stored in My Account Settings are not encrypted in the database, allowing databa...

CVE-2024-11670

Devolutions Remote Desktop Manager versions 2024.2.21 and earlier on Windows are vulnerable to an incorrect authorization flaw in the permission validation component . This vulnerability allows a malicious authenticated user to bypass the "View Password" permission through specific actions, poten...

CVE-2025-2600

Devolutions Remote Desktop Manager for Windows contains an improper authorization vulnerability in the variable component. This flaw allows an authenticated user to use the ELEVATED_PASSWORD variable, bypassing the restrictions set by the "Allow password in variable policy" . Affected versions in...

CVE-2021-28047

CVE-2021-28047 affects Devolutions Remote Desktop Manager. The vulnerability is a Cross-Site Scripting (XSS) in Administration Reports present in versions prior to 2021.1, exploitable by a remote authenticated user who can inject arbitrary web script or HTML via multiple input fields. The connect...

CVE-2023-1202

Devolutions Remote Desktop Manager (RDM) 2023.1.9 and earlier versions are affected by a permission-bypass flaw in the User vault: under ID collision, a user with restricted rights can bypass entry permissions during import or synchronization. The vulnerability affects the ability to control acce...

CVE-2023-5766

CVE-2023-5766 affects Devolutions Remote Desktop Manager, with vulnerable versions 2023.2.33 and earlier on Windows. The issue allows remote code execution from another Windows user session on the same host via a specially crafted TCP packet. This is a network-based vulnerability, with the descri...

CVE-2024-11671

Devolutions Remote Desktop Manager versions 2024.3.17 and earlier on Windows are vulnerable to an improper authentication flaw in the SQL data source MFA validation. An authenticated user can bypass Multi-Factor Authentication (MFA) by performing data source switching , potentially leading to una...

CVE-2025-5334

The Devolutions Remote Desktop Manager application contains a vulnerability in the user vaults component that allows authenticated users to gain unauthorized access to private personal information. The root cause is that entries may be unintentionally moved from user vaults to shared vaults when ...

CVE-2025-2562

Devolutions Remote Desktop Manager on Windows is vulnerable to insufficient logging in its autotyping feature . This flaw allows an authenticated user to utilize a stored password without generating a corresponding log event when using the autotyping functionality. Affected versions include 2025....

CVE-2024-11672

Devolutions Remote Desktop Manager version 2024.2.21 and earlier on Windows is vulnerable to an incorrect authorization flaw in the add permission component . An authenticated malicious user can bypass the "Add" permission by utilizing the import in vault feature. To remediate this, users should ...

CVE-2024-12149

Devolutions Remote Desktop Manager versions 2024.3.19.0 and earlier on Windows are vulnerable to an incorrect permission assignment within the temporary access requests component . This flaw allows an authenticated user to request temporary permissions on an entry and obtain greater privileges th...

CVE-2025-2499

A client-side access control bypass exists in the permission component of Devolutions Remote Desktop Manager on Windows. An authenticated user can perform specific actions to bypass restrictions on View Password , Edit Asset , and Edit Permissions . Affected versions include 2024.3.29 and earlier...

CVE-2025-1636

Devolutions Remote Desktop Manager version 2024.3.29 and earlier on Windows is vulnerable to a faulty business logic error. This flaw exists in the My Personal Credentials password history component , where an authenticated user can inadvertently leak My Personal Credentials into a shared vault w...

CVE-2023-0463

Devolutions Remote Desktop Manager versions 2022.3.29 through 2022.3.30 are vulnerable to a flaw where the force offline MFA prompt setting is ignored when the application switches to offline mode. This allows a user to save sensitive data on disk . As a mitigation, it is recommended to disable t...

CVE-2024-6057

Devolutions Remote Desktop Manager versions 2024.1.31.0 and earlier are affected by an improper authentication vulnerability in the vault password feature. An attacker who has compromised access to an RDM instance can bypass the vault master password by utilizing the offline mode feature. The sev...

CVE-2026-12161

Devolutions Remote Desktop Manager versions 2026.2.5.0 through 2026.2.7.0 and 2026.1.23.0 and earlier are vulnerable to a command injection flaw. The root cause is improper input validation within the SSH Elevate Shell feature. An authenticated user with permissions to create or modify a shared S...

CVE-2024-6354

Devolutions Remote Desktop Manager versions 2024.2.11 and earlier on Windows are affected by an improper access control vulnerability in the PAM dashboard . This flaw allows an authenticated user to bypass the execute permission through the dashboard. As a temporary workaround, it is recommended ...

CVE-2024-0589

CVE-2024-0589 is an XSS vulnerability in Devolutions Remote Desktop Manager (RDM) for Windows, affecting version 2023.3.36 and earlier. The issue resides in the entry overview tab, where an attacker with access to a data source can inject a malicious script via a specially crafted input in an ent...

CVE-2024-6055

The Devolutions Remote Desktop Manager software (version 2024.1.32.0 and earlier) on Windows is vulnerable to the improper removal of sensitive information during the data source export process. This flaw occurs because the application fails to scrub certain data before storage or transfer, allow...

CVE-2023-1574

Devolutions Remote Desktop Manager ≤ 2023.1.9 (Windows) has an information-disclosure flaw in the MSSQL user-creation feature: the error dialog reveals the password in clear text when UI access is available. Impact is confidential data exposure with low user interaction, no exploitation vector be...

CVE-2023-4417

The CVE-2023-4417 issue affects Devolutions Remote Desktop Manager for Windows up to 2023.2.19, caused by improper access controls in the entry duplication component. An authenticated user can, under certain conditions, share a personal vault entry with shared vaults via an incorrect vault during...

CVE-2024-2403

CVE-2024-2403 affects Devolutions Remote Desktop Manager prior to 2024.1.12 on Windows. The root cause is improper cleanup in the temporary file handling component, which may allow an attacker who has already compromised a user endpoint to access sensitive information via residual files in the te...

CVE-2024-11621

Devolutions Remote Desktop Manager is vulnerable to a trust management issue caused by missing certificate validation . This flaw allows an attacker to perform a man-in-the-middle (MITM) attack to intercept and modify encrypted communications. The vulnerability affects the following versions: mac...

CVE-2024-6492

The Devolutions Remote Desktop Manager (versions 2024.2.14.0 and earlier) on Windows is vulnerable to the exposure of sensitive information within its edge browser session proxy feature. This flaw allows an attacker to intercept proxy credentials by visiting a specially crafted website. To mitiga...

CVE-2023-1980

CVE-2023-1980: Devolutions Remote Desktop Manager (versions ≤ 2022.3.35) contains a two-factor authentication bypass that lets an attacker cancel 2FA via the application UI and access entries. The vulnerability is evidenced in multiple databases (NVD, CVE listings) with a CVSSv3.1 base score of 6...

CVE-2023-6593

CVE-2023-6593 concerns a client-side permission bypass in Devolutions Remote Desktop Manager (iOS) 2023.3.4.0 and earlier. According to Red Hat and related sources, an attacker who has access to the application can execute entries in a SQL data source without restriction. The vulnerability is des...

CVE-2023-5765

The CVE-2023-5765 entry concerns Devolutions Remote Desktop Manager (Windows) with versions 2023.2.33 and earlier, where an improper access control in the password analyzer allows bypassing permissions via data source switching. Exploitation details are not provided in the documents, and the core...

CVE-2026-0747

Devolutions Remote Desktop Manager versions 2025.3.24.0 through 2025.3.28.0 on Windows are vulnerable to a sensitive information exposure flaw. The issue resides in the TeamViewer entry dashboard component , where a defective masking feature allows an external observer to view a password on the s...

CVE-2026-12162

The Devolutions Remote Desktop Manager version 2026.2.8 and earlier is affected by an improper host validation vulnerability in its social login autofill feature. An attacker can exploit this by using a crafted web entry that points to a provider lookalike domain , which may lead to the disclosur...

CVE-2024-3545

Devolutions Remote Desktop Manager (version 2024.1.20 and earlier on Windows) and Devolutions Server (version 2024.1.8 and earlier) are vulnerable to improper permission handling within the vault offline cache feature. This flaw allows an attacker with physical or local access to a computer where...

CVE-2023-1939

CVE-2023-1939 concerns a lack of access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager. Affected products: Windows 2022.3.33.0 and prior; Linux 2022.3.2.0 and prior. Impact: non-admin users can view OTP keys via the user interface. Root cause: insufficient authorizat...

CVE-2023-2282

Devolutions Remote Desktop Manager suffers improper access control in the Web Login listener (affecting 2023.1.22 and earlier). An authenticated user can bypass administrator-imposed Web Login restrictions and access restricted entries via an unexpected vector. The NVD CVE entry lists a MEDIUM/LO...

CVE-2023-7047

The CVE-2023-7047 entry concerns Devolutions Remote Desktop Manager. Affected software: Devolutions Remote Desktop Manager versions 2023.3.31 and earlier. Root cause: inadequate validation of permissions when using remote tools and macros via the context menu. Impact: a user could initiate a conn...

CVE-2026-2590

Devolutions Remote Desktop Manager versions 2025.3.30 and earlier (and versions prior to 2026.1.6 ) are vulnerable to a sensitive information exposure flaw. The connection entry component fails to properly enforce the "Disable password saving in vaults" setting. This allows an authenticated user ...