CVE-2025-2499

Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to bypass certain permission restrictions—specifically View Password, Edit Asset, and Edit Permissions by performing specific actions. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.

• CWE-284

• https://devolutions.net/security/advisories/DEVO-2025-0005/Vendor Advisory

Published

Mar 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24984Insertion of sensitive information into log file in Windows …4.6
• CVE-2025-24985Integer overflow or wraparound in Windows Fast FAT Driver al…7.8
• CVE-2025-24986Improper isolation or compartmentalization in Azure PromptFl…6.5
• CVE-2025-24987Out-of-bounds read in Windows USB Video Driver allows an aut…6.8
• CVE-2025-24988Out-of-bounds read in Windows USB Video Driver allows an aut…6.8
• CVE-2025-24989An improper access control vulnerability in Power Pages allo…9.8
• CVE-2025-24990Microsoft is aware of vulnerabilities in the third party Age…7.8
• CVE-2025-24991Out-of-bounds read in Windows NTFS allows an authorized atta…5.5
• CVE-2025-24992Buffer over-read in Windows NTFS allows an unauthorized atta…5.5
• CVE-2025-24993Heap-based buffer overflow in Windows NTFS allows an unautho…7.8
• CVE-2025-24994Improper access control in Windows Cross Device Service allo…7.3
• CVE-2025-24995Heap-based buffer overflow in Kernel Streaming WOW Thunk Ser…7.8