CVE-2025-2499

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to bypass certain permission restrictions—specifically View Password, Edit Asset, and Edit Permissions by performing specific actions.

This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Mar 26, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-249907.8Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. TCVE-2025-249915.5Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.CVE-2025-249925.5Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally.CVE-2025-249937.8Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.CVE-2025-249947.3Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.CVE-2025-249957.8Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.CVE-2025-249966.5External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.CVE-2025-249974.4Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally.CVE-2025-249987.3Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-249998.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-25007.4A vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gaiCVE-2025-250008.8Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute