by Kastro
Paper/Archive/CVE-2024-6057

CVE-2024-6057

Devolutions Remote Desktop Manager — Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker th…

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.3.603 × 2012.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature.

Affected

ProductAffectedFixed inSource
Remote Desktop Manager≤ 2024.1.31.0–CNA
remote_desktop_manager≤ 2024.1.31.0–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdevolutions.net/security/advisories/DEVO-2024-0008