CVE-2025-5334
Last modified
CVE-2025-5334 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users. This issue affects the following versions : * Remote Desktop Manager Windows 2025.1.34.0 and earlier * Remote Desktop Manager macOS 2025.1.16.3 and earlier * Remote Desktop Manager Android 2025.1.3.3 and earlier * Remote Desktop Manager iOS 2025.1.6.0 and earlier. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users. This issue affects the following versions : * Remote Desktop Manager Windows 2025.1.34.0 and earlier * Remote Desktop Manager macOS 2025.1.16.3 and earlier * Remote Desktop Manager Android 2025.1.3.3 and earlier * Remote Desktop Manager iOS 2025.1.6.0 and earlier
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Devolutions | Remote Desktop Manager | <= 2025.1.16.3 |
| Devolutions | Remote Desktop Manager | < 2025.1.37.0 |
| Devolutions | Remote Desktop Manager | < 2025.2.0.0 |
| Devolutions | Remote Desktop Manager | < 2025.2.0.17 |
References
- https://devolutions.net/security/advisories/DEVO-2025-0009Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-5334?
How severe is CVE-2025-5334?
How do I fix CVE-2025-5334?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-53334Improper Control of Filename for Include/Require Statement i…8.1
- CVE-2025-53335Improper Control of Filename for Include/Require Statement i…8.1
- CVE-2025-53336Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-53337Missing Authorization vulnerability in Ashan Perera LifePres…5.4
- CVE-2025-53338Cross-Site Request Forgery (CSRF) vulnerability in dor re.pl…7.1
- CVE-2025-53339Improper Control of Filename for Include/Require Statement i…7.5
- CVE-2025-53340Missing Authorization vulnerability in awesomesupport Awesom…5.3
- CVE-2025-53341Missing Authorization vulnerability in Themovation App, SaaS…4.3
- CVE-2025-53342Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2025-53343Missing Authorization vulnerability in GoodLayers Modernize …4.3
- CVE-2025-53344Cross-Site Request Forgery (CSRF) vulnerability in ThimPress…4.3
- CVE-2025-53345Missing Authorization vulnerability leading to code executio…8.8
Are you affected by CVE-2025-5334?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST