CVE-2025-1635 Overview
CVE-2025-1635 is an information exposure vulnerability in Devolutions Remote Desktop Manager on Windows. The flaw affects versions 2024.3.29 and earlier. When a user exports a hub data source, faulty business logic includes the user's authenticated session in the exported file. Any recipient of the export can reuse that session to access the hub as the exporting user. The vulnerability is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and is documented in Devolutions Security Advisory DEVO-2025-0004.
Critical Impact
A hub data source export produced by an affected client contains the exporter's authenticated session, allowing anyone who obtains the export file to impersonate the user against the hub.
Affected Products
- Devolutions Remote Desktop Manager Free for Windows, versions 2024.3.29 and earlier
- Devolutions Remote Desktop Manager Team for Windows, versions 2024.3.29 and earlier
- Windows platform installations using the hub data source export feature
Discovery Timeline
- 2025-03-13 - CVE-2025-1635 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1635
Vulnerability Analysis
Remote Desktop Manager (RDM) provides a hub data source that stores shared entries and credentials in Devolutions Hub. The client offers an export capability that packages entries for backup or transfer. In affected versions, the export routine embeds the authenticated session state of the user performing the export inside the resulting file. The export therefore functions as a bearer token for the hub in addition to carrying entry data.
A low-privileged authenticated user can trigger this behavior through normal use of the product. Once the export leaves the endpoint through email, file share, or backup storage, any actor who reads the file can present the embedded session to the hub and act as the exporting user. This creates a confidentiality impact against every entry the exporter can access, including stored secrets and connection metadata.
Root Cause
The root cause is a business logic defect in the export serializer. Session material that should remain local to the authenticated client process is written into the export payload alongside the intended data. There is no separation between transportable entry data and non-transportable session state, and no post-export sanitization step removes credentials from the serialized output.
Attack Vector
Exploitation requires an existing authenticated Remote Desktop Manager user to produce a hub data source export. The attacker does not need to compromise the endpoint directly. Any exposure of the export file, through shared drives, ticketing systems, cloud storage, or accidental distribution, allows a network-based attacker to replay the embedded session against the hub and read hub-accessible data.
No verified public proof-of-concept code is available for CVE-2025-1635. Refer to the Devolutions Security Advisory DEVO-2025-0004 for vendor-provided technical detail.
Detection Methods for CVE-2025-1635
Indicators of Compromise
- Presence of Remote Desktop Manager hub data source export files (.rdm, .json, or archive formats) in mailboxes, shared folders, or cloud storage that were not produced by an approved backup process.
- Hub authentication events originating from IP addresses or user agents that do not match the legitimate user's endpoint.
- Access to hub entries from geographic locations or times inconsistent with the user's normal activity.
Detection Strategies
- Inventory Remote Desktop Manager client versions across Windows endpoints and flag any instance at or below 2024.3.29.
- Enable and review Devolutions Hub audit logs for export operations and for session reuse from unexpected sources.
- Scan file shares, email gateways, and endpoint file systems for artifacts matching known Remote Desktop Manager export file signatures.
Monitoring Recommendations
- Alert on repeated hub session activity from a single account across disparate source IP addresses within short time windows.
- Correlate Remote Desktop Manager export events with subsequent hub logins to detect potential session replay.
- Monitor data loss prevention (DLP) channels for outbound transfers of Remote Desktop Manager export files.
How to Mitigate CVE-2025-1635
Immediate Actions Required
- Upgrade all Windows installations of Remote Desktop Manager to a version later than 2024.3.29 as identified in Devolutions Security Advisory DEVO-2025-0004.
- Revoke and rotate any hub sessions belonging to users who previously produced hub data source exports on affected versions.
- Locate and securely delete existing hub data source export files that may contain embedded sessions.
Patch Information
Devolutions addresses the flaw in Remote Desktop Manager releases after 2024.3.29. Consult the Devolutions Security Advisory DEVO-2025-0004 for the exact fixed build numbers and download instructions for both the Free and Team editions on Windows.
Workarounds
- Restrict use of the hub data source export feature to administrators until all clients are patched.
- Enforce shorter hub session lifetimes so any leaked session expires quickly.
- Require exports to be produced only on isolated administrative workstations and stored in access-controlled locations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
