Skip to main content

Devolutions Server CVE-2025-5382

| EUVDEUVD-2025-16998 MEDIUM
Improper Access Control (CWE-284)
2025-06-05 security@devolutions.net
Authentication Bypass Devolutions Server
6.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.8 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

3
EUVD ID Assigned
Mar 14, 2026 - 17:53 euvd
EUVD-2025-16998
Analysis Generated
Mar 14, 2026 - 17:53 vuln.today
CVE Published
Jun 05, 2025 - 14:15 nvd
MEDIUM 6.8

DescriptionCVE.org

Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA.

Analysis

Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA.

Technical ContextAI

This vulnerability is classified as Improper Access Control (CWE-284).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

More in Devolutions Server

View all
CVE-2026-3204 CRITICAL
9.8 Mar 03

Input validation flaw in Devolutions Server error message page enables remote spoofing attacks.
CVE-2026-3224 CRITICAL
9.8 Mar 03

Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
CVE-2026-0610 CRITICAL
9.8 Jan 19

Devolutions Server 2025.3.1 through 2025.3.6 contains a SQL injection vulnerability in the remote sessions component tha
CVE-2026-3130 CRITICAL
9.8 Mar 03

Behavioral control bypass in Devolutions Server 2025.3.15 allows authenticated users to exploit delete permissions.
CVE-2024-2921 CRITICAL
9.8 Mar 26

Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated u
CVE-2021-23921 CRITICAL
9.1 Apr 01

An issue was discovered in Devolutions Server before 2020.3. Rated critical severity (CVSS 9.1), this vulnerability is r
CVE-2025-13757 HIGH
8.8 Nov 27

SQL Injection vulnerability in last usage logs in Devolutions Server.2.20, through 2025.3.8. Rated high severity (CVSS 8
CVE-2024-2915 HIGH
8.8 Mar 26

Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access t
CVE-2023-0953 HIGH
8.8 Mar 01

Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authe
CVE-2023-0951 HIGH
8.8 Mar 01

Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privil
CVE-2022-33996 HIGH
8.8 Jul 07

Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inh
CVE-2025-4433 HIGH
8.7 May 30

Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrativ

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2025-5382 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy