fkie_cve-2025-6523
Vulnerability from fkie_nvd
Published
2025-07-22 17:15
Modified
2025-07-25 15:29
Severity ?
7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.3.0 * Devolutions Server 2025.1.11.0 and earlier
References
security@devolutions.nethttps://devolutions.net/security/advisories/DEVO-2025-0012/
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe.\n\nThis issue affects the following versions :\n\n  *  Devolutions Server 2025.2.2.0 through 2025.2.3.0\n  *  \nDevolutions Server 2025.1.11.0 and earlier"
    },
    {
      "lang": "es",
      "value": "El uso de credenciales d\u00e9biles en el componente de autenticaci\u00f3n de emergencia de Devolutions Server permite a un atacante no autenticado eludir la autenticaci\u00f3n mediante fuerza bruta los c\u00f3digos de emergencia cortos generados por el servidor dentro de un plazo razonable. Este problema afecta a las siguientes versiones: * Devolutions Server 2025.2.2.0 a 2025.2.3.0 * Devolutions Server 2025.1.11.0 y anteriores"
    }
  ],
  "id": "CVE-2025-6523",
  "lastModified": "2025-07-25T15:29:44.523",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-07-22T17:15:33.900",
  "references": [
    {
      "source": "security@devolutions.net",
      "url": "https://devolutions.net/security/advisories/DEVO-2025-0012/"
    }
  ],
  "sourceIdentifier": "security@devolutions.net",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1391"
        }
      ],
      "source": "security@devolutions.net",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.