CVE-2025-2499 - CVE House

Back to Database

Status published Unknown CVE-2025-2499

Client side access control bypass in the permission component in...

0 CVSS

Vulnerability Description

Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to bypass certain permission restrictions—specifically View Password, Edit Asset, and Edit Permissions by performing specific actions. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2499

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://devolutions.net/security/advisories/DEVO-2025-0005/

More from Devolutions

View All →

UI synchronization issue in the Just-in-Time (JIT) access request approval...

Deadlock in PAM automatic check-in feature in Devolutions Server allows...

Improper access control in secure message component in Devolutions Server...

Use of weak credentials in emergency authentication component in Devolutions...

Improper access control in users MFA feature in Devolutions Server...

Affected Vendor

Devolutions

View all reports →

Affected Software

Remote Desktop Manager

Vulnerable Versions:

2025.1.24, 0

Timeline

Official Publish: March 26th, 2025

Last Modified: March 26th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation