Portail 
Forum 
Devolutions Force 
Hub Business 
Hub Personal 
Devolutions Send 
Devolutions Academy 
RDM 
Workspace 
Launcher 
Sécurité et conformité
DEVO-2025-0014
Résumé
Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.
Produits affectés
Devolutions Server 2025.3.2 and earlier
Journal des modifications
14/10/2025 - Initial publication
Sévérité
High
Produit
Devolutions Server
Version corrigée
2025.2.15, 2025.3.3
Lack of TLS domain validation when connecting to gateways
Description
The TLS certificate validation when connecting to a Devolutions Gateway failed to validate that the subject of the certificate matched the domain name of the host. This could allow attackers in a MitM position to intercept or tamper traffic between Devolutions Server and a Gateway.
The security of the sessions going through the gateway is not impacted, as the certificate is also validated on the endpoints when initiating a connection.
Mesures correctives et solutions de contournement
Update to Devolutions Server 2025.3.3 or higher, 2025.2.15 or higher
Sévérité
7.7 High - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produits affectés
Devolutions Server 2025.3 and earlier
CVE(s)
CVE-2025-11619
