{"id":"CVE-2024-11621","state":"PUBLISHED","title":"Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-","description":"Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack.\n\nVersions affected are :\nRemote Desktop Manager macOS 2024.3.9.0 and earlier\nRemote Desktop Manager Linux 2024.3.2.5 and earlier\nRemote Desktop Manager Android  2024.3.3.7 and earlier\nRemote Desktop Manager iOS 2024.3.3.0 and earlier\n\nRemote Desktop Manager Powershell 2024.3.6.0 and earlier","publishedAt":"2025-02-10T13:55:29.155Z","updatedAt":"2025-02-12T15:17:11.387Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"DEVOLUTIONS","products":["Devolutions Remote Desktop Manager"],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.9.0","versionType":"custom"}],"platforms":["MacOS"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.2.5","versionType":"custom"}],"platforms":["Linux"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.3.7","versionType":"custom"}],"platforms":["Android"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.3.0","versionType":"custom"}],"platforms":["iOS"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.6.0","versionType":"custom"}],"platforms":["Powershell"]}],"references":["https://devolutions.net/security/advisories/DEVO-2025-0001/"],"weaknesses":["CWE-295"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/11xxx/CVE-2024-11621.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-11621","state":"PUBLISHED","datePublished":"2025-02-10T13:55:29.155Z","dateUpdated":"2025-02-12T15:17:11.387Z","assignerShortName":"DEVOLUTIONS","assignerOrgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateReserved":"2024-11-22T13:56:59.218Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack.\n\nVersions affected are :\nRemote Desktop Manager macOS 2024.3.9.0 and earlier\nRemote Desktop Manager Linux 2024.3.2.5 and earlier\nRemote Desktop Manager Android  2024.3.3.7 and earlier\nRemote Desktop Manager iOS 2024.3.3.0 and earlier\n\nRemote Desktop Manager Powershell 2024.3.6.0 and earlier"}],"affected":[{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.9.0","versionType":"custom"}],"platforms":["MacOS"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.2.5","versionType":"custom"}],"platforms":["Linux"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.3.7","versionType":"custom"}],"platforms":["Android"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.3.0","versionType":"custom"}],"platforms":["iOS"]},{"vendor":"Devolutions","product":"Remote Desktop Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2024.3.6.0","versionType":"custom"}],"platforms":["Powershell"]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2025-0001/"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","description":"CWE-295: Improper Certificate Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"DEVOLUTIONS","orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateUpdated":"2025-02-10T14:07:31.977Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-02-10T15:38:05.343392Z","id":"CVE-2024-11621","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-12T15:17:11.387Z"}}]}}}