CVE-2023-1980 Auth bypass in Remote Desktop Manager

Medium 6.5 Published 11 Apr 2023 Updated 10 Feb 2025

Attackers can bypass two-factor authentication in Devolutions Remote Desktop Manager to access stored credentials and entries.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-1980?

CVE-2023-1980 is a medium-severity authentication bypass vulnerability in Devolutions Remote Desktop Manager, published on 11 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Two factor

authentication

bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor authentication via the application user interface and open entries.

Weakness: CWE-287

Which versions are affected by CVE-2023-1980?

It affects 1 product.

Products include Devolutions Remote Desktop Manager.

How do I fix CVE-2023-1980?

No fix has been published for CVE-2023-1980 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-1980 being exploited?

There is no known exploitation of CVE-2023-1980 in the wild and no public exploit code.

All Devolutions Remote Desktop Manager vulnerabilities

Sources

Also known as GHSA-5775-m3qf-xc33.