CVE-2024-6354 Overview
CVE-2024-6354 is an improper access control vulnerability [CWE-1262] in the Privileged Access Management (PAM) dashboard of Devolutions Remote Desktop Manager (RDM) for Windows. The flaw affects versions 2024.2.11 and earlier. An authenticated user can bypass the execute permission by leveraging the PAM dashboard, gaining access to actions that should be restricted by role-based controls.
The vulnerability enables privilege escalation within the RDM environment. Attackers who already hold valid credentials can operate beyond their assigned permissions on managed privileged accounts and connections.
Critical Impact
Authenticated users can bypass execute permission checks through the PAM dashboard, resulting in unauthorized use of privileged credentials managed by Remote Desktop Manager.
Affected Products
- Devolutions Remote Desktop Manager Free for Windows (versions ≤ 2024.2.11)
- Devolutions Remote Desktop Manager Team for Windows (versions ≤ 2024.2.11)
- Windows deployments using the PAM dashboard component
Discovery Timeline
- 2024-06-26 - CVE-2024-6354 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-6354
Vulnerability Analysis
Remote Desktop Manager centralizes remote connections and privileged credentials for administrators. The PAM module manages checkout, rotation, and use of privileged accounts. Access to these operations is enforced through role-based permissions, including a specific execute permission that governs whether a user can launch sessions or use credentials.
The vulnerability lies in how the PAM dashboard evaluates these permission checks. The dashboard exposes actions on privileged accounts without consistently enforcing the execute permission that the underlying model requires. An authenticated user without execute rights can trigger those actions through the dashboard interface and reach credentials or sessions outside their authorized scope.
The impact scales with the privileges of the PAM-managed accounts. Because RDM often stores domain administrator, service, and infrastructure credentials, a bypass here directly translates to broader access across the network.
Root Cause
The underlying weakness is a non-transparent sharing of resources between security domains [CWE-1262]. The PAM dashboard reuses PAM data paths without repeating the execute permission check enforced elsewhere in the application. Authorization state does not propagate uniformly across dashboard actions, creating a bypass path.
Attack Vector
An attacker must first authenticate to Remote Desktop Manager with valid user credentials. Once authenticated, the attacker navigates to the PAM dashboard and invokes privileged actions that should be blocked by their role. The exploitation does not require user interaction from a victim or local access to the host running RDM.
See the Devolutions Security Advisory DEVO-2024-0010 for vendor-confirmed technical details.
Detection Methods for CVE-2024-6354
Indicators of Compromise
- PAM dashboard activity from user accounts that lack execute permissions on the referenced privileged accounts
- Credential checkouts or session launches attributed to users outside the expected administrator group
- Access to PAM-managed credentials at unusual hours or from unexpected workstations
- Audit-log gaps or inconsistencies between PAM permission changes and observed dashboard actions
Detection Strategies
- Review Remote Desktop Manager audit logs for PAM dashboard events correlated with user roles that should not permit execution
- Compare permission assignments in the RDM data source against the users invoking PAM actions
- Alert on any use of high-value PAM-managed accounts by non-privileged RDM users
Monitoring Recommendations
- Forward RDM and PAM audit logs to a centralized logging or SIEM platform for correlation with identity events
- Monitor downstream authentication events for privileged accounts stored in PAM, including domain controllers and jump hosts
- Track version and patch level of RDM clients across the estate to identify hosts still running 2024.2.11 or earlier
How to Mitigate CVE-2024-6354
Immediate Actions Required
- Upgrade Devolutions Remote Desktop Manager for Windows to a version later than 2024.2.11 as directed in advisory DEVO-2024-0010
- Rotate credentials for privileged accounts managed through PAM if unauthorized dashboard access is suspected
- Audit PAM role assignments and remove standing execute permissions that are not required for daily operations
Patch Information
Devolutions addressed CVE-2024-6354 in Remote Desktop Manager releases following 2024.2.11. Refer to the Devolutions Security Advisory for the specific fixed version and upgrade guidance. Apply the patch to all Windows clients that connect to shared RDM data sources.
Workarounds
- Restrict access to the PAM dashboard to a minimal set of trusted administrators until patched
- Enforce least privilege on RDM user roles and remove access to sensitive PAM entries where not strictly required
- Require multi-factor authentication for RDM logins to raise the bar for authenticated exploitation
- Increase audit logging verbosity on the RDM data source to capture PAM dashboard interactions
# Verify the installed Remote Desktop Manager version on Windows clients
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" `
| Where-Object { $_.DisplayName -like "Remote Desktop Manager*" } `
| Select-Object DisplayName, DisplayVersion, Publisher
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
