PT-2025-6043 · Devolutions · Devolutions Remote Desktop Manager

Published 2025-02-10 · Updated 2025-02-14 · CVE-2024-11621

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Devolutions Remote Desktop Manager macOS versions 2024.3.9.0 and earlier Devolutions Remote Desktop Manager Linux versions 2024.3.2.5 and earlier Devolutions Remote Desktop Manager Android versions 2024.3.3.7 and earlier Devolutions Remote Desktop Manager iOS versions 2024.3.3.0 and earlier Devolutions Remote Desktop Manager Powershell versions 2024.3.6.0 and earlier

Description The issue is related to missing certificate validation in Devolutions Remote Desktop Manager, which allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack. This affects the software on various platforms, including macOS, iOS, Android, Linux, and Powershell.

Recommendations For Devolutions Remote Desktop Manager macOS versions 2024.3.9.0 and earlier, update to a version later than 2024.3.9.0 to resolve the issue. For Devolutions Remote Desktop Manager Linux versions 2024.3.2.5 and earlier, update to a version later than 2024.3.2.5 to resolve the issue. For Devolutions Remote Desktop Manager Android versions 2024.3.3.7 and earlier, update to a version later than 2024.3.3.7 to resolve the issue. For Devolutions Remote Desktop Manager iOS versions 2024.3.3.0 and earlier, update to a version later than 2024.3.3.0 to resolve the issue. For Devolutions Remote Desktop Manager Powershell versions 2024.3.6.0 and earlier, update to a version later than 2024.3.6.0 to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2024-11621

Affected Products

Devolutions Remote Desktop Manager

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-11621 · Security Note
• https://devolutions.net/security/advisories/DEVO-2025-0001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-11621 · Vendor Advisory
• https://twitter.com/cracbot/status/1890355496747692326 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1888966586792357911 · Twitter Post
• https://twitter.com/cybercronai/status/1889122298474483818 · Twitter Post
• https://twitter.com/CCBalert/status/1889332662071853060 · Twitter Post
• https://t.me/cvedetector/17558 · Telegram Post
• https://t.me/cvenotify/110563 · Telegram Post
• https://twitter.com/CVEnew/status/1888954598968131708 · Twitter Post