CVE-2025-5334

Estado: AnalizadaAlta (7.5)—

Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information.

Under specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users.

This issue affects the following versions :

Detalles técnicos trazas, registros y código del informe original

  *  Remote Desktop Manager Windows 2025.1.34.0 and earlier
  *  
Remote Desktop Manager macOS 2025.1.16.3 and earlier

  *  
Remote Desktop Manager Android 2025.1.3.3 and earlier
  *  
Remote Desktop Manager iOS 2025.1.6.0 and earlier

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.57%
Percentil entre todas las CVEs puntuadas: 45
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution75 %
Impacto principalT1005 Data from Local Systemcollection85 %
Impacto secundarioT1552 Unsecured Credentialscredential access70 %

UI:R y acceso autenticado sugieren interacción del usuario (T1203). El atacante accede a información privada en vaults (T1005, T1552) al mover entradas a vaults compartidos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Update Software Active Directory Configuration User Training Restrict File and Directory Permissions Privileged Account Management Password Policies

Tecnologías afectadas (1)

Devolutions — Remote Desktop Manager

CWE

CWE-359
CWE-200

Referencias

https://devolutions.net/security/advisories/DEVO-2025-0009

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-5334",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-5334",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-29T14:59:46.593959Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security@devolutions.net",
      "affectedData": [
        {
          "vendor": "Devolutions",
          "product": "Remote Desktop Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2025.1.34.0"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Devolutions",
          "product": "Remote Desktop Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2025.1.3.3"
            }
          ],
          "platforms": [
            "Android"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Devolutions",
          "product": "Remote Desktop Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2025.1.5.0"
            }
          ],
          "platforms": [
            "iOS"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Devolutions",
          "product": "Remote Desktop Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2025.1.16.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-29T15:15:34.650",
  "references": [
    {
      "url": "https://devolutions.net/security/advisories/DEVO-2025-0009",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@devolutions.net"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@devolutions.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-359"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager\nallows an authenticated user to gain unauthorized access to private personal information. \n\n\n\nUnder specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users.\n\n\n\n\nThis issue affects the following versions :\n\n  *  Remote Desktop Manager Windows 2025.1.34.0 and earlier\n  *  \nRemote Desktop Manager macOS 2025.1.16.3 and earlier\n\n\n\n  *  \nRemote Desktop Manager Android 2025.1.3.3 and earlier\n  *  \nRemote Desktop Manager iOS 2025.1.6.0 and earlier"
    },
    {
      "lang": "es",
      "value": "La exposición de información personal privada a un agente no autorizado en el componente de bóvedas de usuario de Devolutions Remote Desktop Manager permite que un usuario autenticado obtenga acceso no autorizado a información personal privada. En determinadas circunstancias, las entradas pueden moverse involuntariamente de las bóvedas de usuario a bóvedas compartidas al ser editadas por sus propietarios, lo que las hace accesibles a otros usuarios. Este problema afecta a las siguientes versiones: * Remote Desktop Manager Windows 2025.1.34.0 y anteriores."
    }
  ],
  "lastModified": "2026-06-17T09:47:42.393",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:-:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7A2ADF2-40C8-4E84-8AC7-2F075D21FBF4",
              "versionEndIncluding": "2025.1.16.3"
            },
            {
              "criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:free:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F9A3FD9-411D-4776-83D4-69358524788B",
              "versionEndExcluding": "2025.1.37.0"
            },
            {
              "criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:team:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "537E8F76-0ED5-4CC6-85F7-207D00DFE8E2",
              "versionEndExcluding": "2025.1.37.0"
            },
            {
              "criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:-:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FE18CF1-7816-43C9-9B25-3E53ECFB3442",
              "versionEndExcluding": "2025.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:-:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA1D059E-BADD-483A-A230-7262BE12040A",
              "versionEndExcluding": "2025.2.0.17"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@devolutions.net"
}