ByteOS Network

NVD Vulnerability Details :

CVE-2025-12808

Analyzed

Source-security@devolutions.net

Published At-06 Nov, 2025 | 17:15

Updated At-10 Nov, 2025 | 16:30

Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure. This issue affects the following versions : * Devolutions Server 2025.3.2.0 through 2025.3.5.0 * Devolutions Server 2025.2.15.0 and earlier

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CPE Matches

Devolutions

>>devolutions_server>>Versions before 2025.2.17.0(exclusive)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

Devolutions

>>devolutions_server>>Versions from 2025.3.2.0(inclusive) to 2025.3.6.0(exclusive)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-284	Secondary	security@devolutions.net

CWE ID: CWE-284

Type: Secondary

Source: security@devolutions.net

References

Hyperlink	Source	Resource
https://devolutions.net/security/advisories/DEVO-2025-0016	security@devolutions.net	Vendor Advisory

Hyperlink: https://devolutions.net/security/advisories/DEVO-2025-0016

Source: security@devolutions.net

Resource:

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History