Portal 
Forum 
Devolutions Force 
Devolutions Hub Business 
Devolutions Hub Personal 
Devolutions Send 
Devolutions Academy 
RDM 
Workspace 
Launcher 
Security & Compliance
DEVO-2025-0014
Zusammenfassung
Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.
Betroffene Produkte
Devolutions Server 2025.3.2 and earlier
Änderungsprotokoll
14/10/2025 - Initial publication
Schweregrad
High
Produkt
Devolutions Server
Behobene Version
2025.2.15, 2025.3.3
Lack of TLS domain validation when connecting to gateways
Beschreibung
The TLS certificate validation when connecting to a Devolutions Gateway failed to validate that the subject of the certificate matched the domain name of the host. This could allow attackers in a MitM position to intercept or tamper traffic between Devolutions Server and a Gateway.
The security of the sessions going through the gateway is not impacted, as the certificate is also validated on the endpoints when initiating a connection.
Behebungen und Workarounds
Update to Devolutions Server 2025.3.3 or higher, 2025.2.15 or higher
Schweregrad
7.7 High - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Betroffene Produkte
Devolutions Server 2025.3 and earlier
CVE(s)
CVE-2025-11619
