CVE-2023-4417
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Devolutions Remote Desktop Manager version 2023.2.19 and earlier, improper access controls in the entry duplication component allow an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data, potentially leading to a loss of confidentiality. Accidental sharing of personal data may also put users at risk.
Recommendation
It is recommended to update Devolutions Remote Desktop Manager to the latest version to mitigate this vulnerability. Additionally, conducting an access audit of vaults is advisable to ensure no unauthorized data sharing has occurred.
Other vulnerabilities in Devolutions Remote Desktop Manager
See all- CVE-2026-2590Critical
In Devolutions Remote Desktop Manager 2025.3.30 and earlier, there is improper enforcement of the Disable password saving in vaults setting. This allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users.
- CVE-2023-4373Critical
Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature.
- CVE-2026-78417Medium
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.
- CVE-2026-13372High
A vulnerability in Devolutions Remote Desktop Manager allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link. The issue affects the custom PowerShell VPN editor in versions 2026.2.5 through 2026.2.11.
- CVE-2026-12162Medium
Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.
Original NVD description (English source)
Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows allows an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.