CVE-2025-6523 CRITICAL

CVE-2025-6523

Vendor Devolutions
Product Server
Weakness CWE-1391
Published July 22, 2025
Last update November 25, 2025
View on NVD All CVEs

CVSS base score

9.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.3.0 * Devolutions Server 2025.1.11.0 and earlier

Key dates

02Disclosure timeline

July 22, 2025 CVE published
November 25, 2025 Record updated