CVE-2024-6354

CVSS 7.2v3.1pub. 2024-06-26upd. 2025-03-28

Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Devolutions Remote Desktop Manager
APP
Devolutions
< 2024.2.12.0

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

CWE

CWE-1262

References

devolutions.net/security/advisories/DEVO-2024-0010…

Related vulnerabilities

CVE-2026-2590CRITICAL9.8PL ✓same product

Błędne egzekwowanie zakazu zapisywania haseł w Devolutions Remote Desktop Manager

CVE-2024-6057CRITICAL9.8PL ✓same product

Pominięcie hasła master vault w Devolutions Remote Desktop Manager

CVE-2023-6593CRITICAL9.8PL ✓same product

Pomijanie uprawnień po stronie klienta w Devolutions Remote Desktop Manager na iOS

CVE-2023-5765CRITICAL9.8PL ✓same product

Nieprawidłowa kontrola dostępu w Remote Desktop Manager — obejście uprawnień

CVE-2023-5766CRITICAL9.8PL ✓same product

RCE w Remote Desktop Manager — atak przez spreparowany pakiet TCP