PT-2025-23282 · Devolutions · Devolutions Server

Gino Boudreau · Published 2025-05-30 · Updated 2025-11-25 · CVE-2025-4433

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.1.7.0 and earlier

Description The issue is related to improper access control in user group management. A non-administrative user with both User Management and User Group Management permissions can perform privilege escalation by adding users to groups with administrative privileges.

Recommendations For Devolutions Server versions 2025.1.7.0 and earlier, restrict access to the User Group Management feature for non-administrative users until a fix is available. Consider removing the User Group Management permission from non-administrative users to minimize the risk of exploitation.

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-4433

Affected Products

Devolutions Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-4433 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4433 · Vendor Advisory
• https://devolutions.net/security/advisories/DEVO-2025-0010 · Vendor Advisory
• https://t.me/cvenotify/124147 · Telegram Post
• https://t.me/cvenotify/127410 · Telegram Post
• https://t.me/cveNotify/143987 · Telegram Post
• https://t.me/cvetracker/25007 · Telegram Post
• https://twitter.com/CVEnew/status/1928438432788857210 · Twitter Post