Paper/Archive/CVE-2025-6523

CVE-2025-6523

Devolutions Server — Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authenti…

EPSS 0.5%CVSS 9.5

critical.is priorityof 100

CVSS 9.5 (CNA)9.5 / 10 × 3028.5 Not in CISA KEV+300.0 EPSS percentile 41.5.415 × 208.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.3.0 * Devolutions Server 2025.1.11.0 and earlier

Affected

ProductAffectedFixed inSource

Server≤ 2025.1.11.0–CNA

Server2025.2.2.0 – 2025.2.3.0–CNA

Scores by source

DEVOLUTIONS (CNA)9.5CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H

CISA ADP7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refdevolutions.net/security/advisories/DEVO-2025-0012