Devolutions Server CVE-2025-11619

Exploitation requires the attacker to first hold an active man-in-the-middle position on the network path between a Devolutions Server component and a gateway it connects to (e.g., ARP/DNS spoofing, rogue wireless AP, or a compromised intermediate hop), and requires a user/client to initiate a connection to the gateway (UI:R). The limiting factors are substantial: no MitM position means no exploitation, and the attack is confined to the client-to-gateway connection flow rather than any default remote service. It affects Devolutions Server 2025.3.2 and earlier; upgrading past that build removes the condition.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) overstates real-world risk relative to the described mechanism. CWE-295 improper certificate validation only becomes exploitable when an attacker already holds a man-in-the-middle position on the network path between a Devolutions Server client and a gateway - a prerequisite the vendor's AC:L rating does not reflect; AC:H is more honest, since achieving MitM (ARP/DNS spoofing, rogue Wi-Fi, compromised upstream hop) is a meaningful precondition. Corroborating low-urgency signals: EPSS is only 0.24% (14th percentile), there is no CISA KEV listing, and no public POC was provided, so this is exploitation status 'no public exploit identified at time of analysis.' Net: a genuine confidentiality/integrity flaw worth patching, but it is a conditional MitM issue rather than a remotely sprayable 'critical' - the 8.8 should be read as high-impact-if-positioned, not high-likelihood. Conflict to verify: AC:L in the vendor vector versus the MitM precondition in the description - AC:H is more defensible.

An attacker who can intercept traffic (e.g., on a shared/compromised LAN, rogue access point, or a poisoned DNS/ARP path) sits between a Devolutions Server component and the gateway it connects to. Because the client fails to properly validate the gateway's certificate, the attacker presents a fraudulent certificate, the connection is established anyway, and the attacker decrypts and/or alters the session traffic. No public exploit code was identified, and the attacker must first obtain the network MitM position.