← Vulnerability feed

Vulnerability record · CVE-2025-5334 · published 29 May 2025

CVE-2025-5334: Devolutions remote desktop manager information exposure vulnerability

Devolutions · Remote Desktop Manager

Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users. This issue affects the following versions : * Remote Desktop Manager Windows 2025.1.34.0 and earlier * Remote Desktop Manager macOS 2025.1.16.3 and earlier * Remote Desktop Manager Android 2025.1.3.3 and earlier * Remote Desktop Manager iOS 2025.1.6.0 and earlier

7.5 CVSS 3.1 High EPSS 0.57% · top 55.1% CWE-359 · CWE-359CWE-200 · Information exposure
7.5CVSS 3.1 base score
0.57%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users. This issue affects the following versions : * Remote Desktop Manager Windows 2025.1.34.0 and earlier * Remote Desktop Manager macOS 2025.1.16.3 and earlier * Remote Desktop Manager Android 2025.1.3.3 and earlier * Remote Desktop Manager iOS 2025.1.6.0 and earlier

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://devolutions.net/security/advisories/DEVO-2025-0009 Vendor Advisory

Track CVE-2025-5334 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-2590Devolutions remote desktop manager improper input validation vulnerabilityImproper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.…EPSS 0.48%9.8CVE-2024-6057Devolutions remote desktop manager improper authentication vulnerabilityImproper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compr…EPSS 0.92%9.8CVE-2023-6593Devolutions remote desktop manager incorrect permission assignment vulnerabilityClient side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the applicati…EPSS 0.73%9.8CVE-2023-5765Devolutions remote desktop manager vulnerabilityImproper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to…EPSS 0.61%9.8CVE-2023-5766Devolutions remote desktop manager vulnerabilityA remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from ano…EPSS 0.58%9.8CVE-2023-4373Devolutions remote desktop manager improper authentication vulnerabilityInadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier …EPSS 0.72%8.8CVE-2026-12161Devolutions remote desktop manager os command injection vulnerabilityImproper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to exe…EPSS 0.44%8.8CVE-2024-11621Devolutions remote desktop manager improper certificate validation vulnerabilityMissing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypt…EPSS 0.23%

Source: NIST National Vulnerability Database (record CVE-2025-5334), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.