Multiple Vulnerabilities in Devolutions Server

The German Federal Office for Information Security (BSI) has released a security advisory regarding multiple vulnerabilities in Devolutions Server. These security flaws allow a remote, authenticated attacker to bypass existing security controls, access unauthorized sensitive information (information disclosure), and successfully perform privilege escalation within the affected software environment.

Defenders should prioritize identifying all instances of Devolutions Server within their network to prepare for vendor-supplied updates. As these vulnerabilities require the attacker to be authenticated, monitoring for anomalous administrative activity or unauthorized changes to permission sets within the application is recommended.

Impact

Successful exploitation of these vulnerabilities allows an authenticated user to move beyond their assigned permission level, potentially gaining administrative access to the Devolutions Server instance. This can lead to the unauthorized disclosure of sensitive data managed by the server and full system compromise if the privilege escalation is chained with other attack vectors. The scope of impact is limited to the Devolutions Server product and its associated managed data.

Recommendation

• Identify all internal Devolutions Server installations and review the vendor portal for the latest security patches.
• Audit user accounts with administrative privileges in Devolutions Server for signs of recent compromise or unusual privilege assignment changes.
• Review application-level access logs for anomalous requests originating from authenticated accounts that deviate from normal usage patterns.
• Follow the vendor security update path as soon as it becomes available to remediate these vulnerabilities.