PT-2025-18693 · Devolutions · Devolutions Server

Published 2025-05-01 · Updated 2025-05-02 · CVE-2025-3517

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.1.5.0 and earlier

Description The issue concerns a privilege context switching error in the PAM JIT feature of Devolutions Server. This error allows a PAM JIT account password to be improperly reset after usage via specific actions, such as editing the username. It also enables a PAM user to elevate a previously configured user configured in a PAM JIT account due to the failure to update the internal account's SID when updating the username.

Recommendations For Devolutions Server versions 2025.1.5.0 and earlier, consider disabling the PAM JIT elevation feature until a patch is available to prevent improper privilege assignment. As a temporary workaround, restrict actions that involve editing usernames in PAM JIT accounts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

CWE-270

Related Identifiers

CVE-2025-3517

Affected Products

Devolutions Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3517 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3517 · Vendor Advisory
• https://devolutions.net/security/advisories/DEVO-2025-0006 · Vendor Advisory
• https://t.me/cvedetector/24280 · Telegram Post
• https://twitter.com/CVEnew/status/1918014590094295535 · Twitter Post
• https://t.me/cvetracker/22857 · Telegram Post
• https://t.me/cvenotify/120624 · Telegram Post
• https://twitter.com/cybercronai/status/1918328486957023434 · Twitter Post